Check: GEN007860
AIX 5.3 STIG:
GEN007860
(in version v1 r3)
Title
The system must ignore IPv6 ICMP redirect messages. (Cat II impact)
Discussion
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
Check Content
Determine if the system is configured to ignore IPv6 ICMP redirect messages. If it is not, this is a finding. # /usr/sbin/no -o ipignoreredirects If the value returned is not 1, this is a finding.
Fix Text
Configure the system to ignore IPv6 ICMP redirect messages. # /usr/sbin/no -p -o ipignoreredirects=1
Additional Identifiers
Rule ID: SV-38825r1_rule
Vulnerability ID: V-22550
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001551 |
The organization defines approved authorizations for controlling the flow of information between interconnected systems. |
Controls
Number | Title |
---|---|
AC-4 |
Information Flow Enforcement |