Check: GEN000000-AIX0210
AIX 5.3 STIG:
GEN000000-AIX0210
(in version v1 r3)
Title
The system must provide protection from Internet Control Message Protocol (ICMP) attacks on TCP connections. (Cat II impact)
Discussion
The ICMP attacks may be of the form of ICMP source quench attacks and Path MTU Discovery (PMTUD) attacks. If this network option tcp_icmpsecure is turned on, the system does not react to ICMP source quench messages. This will protect against ICMP source quench attacks. The payload of the ICMP message is tested to determine if the sequence number of the TCP header portion of the payload is within the range of acceptable sequence numbers. This will mitigate PMTUD attacks to a large extent.
Check Content
Check the value of the tcp_icmpsecure parameter. # /usr/sbin/no -o tcp_icmpsecure If the value returned is not 1, this is a finding.
Fix Text
Set the tcp_icmpsecure parameter to 1. # /usr/sbin/no -p -o tcp_icmpsecure=1
Additional Identifiers
Rule ID: SV-38700r1_rule
Vulnerability ID: V-29496
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000032 |
The information system enforces information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows. |
Controls
Number | Title |
---|---|
AC-4 (8) |
Security Policy Filters |