Check: GEN000000-AIX0230
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE:
GEN000000-AIX0230
(in versions v1 r14 through v1 r10)
Title
The system must provide protection against IP fragmentation attacks. (Cat II impact)
Discussion
The parameter ip_nfrag provides an additional layer of protection against IP fragmentation attacks. The value the ip_nfrag specifies is the maximum number of fragments of an IP packet that can be kept in the IP reassembly queue at any time. The default value of this network option is 200. This is a reasonable value for most environments and offers protection from IP fragmentation attacks.
Check Content
Check the value of the ip_nfrag parameter. # /usr/sbin/no -o ip_nfrag If the result returned is less than 200, this is a finding.
Fix Text
Set the ip_nfrag parameter to 200. # /usr/sbin/no -p -o ip_nfrag=200
Additional Identifiers
Rule ID: SV-38702r1_rule
Vulnerability ID: V-29498
Group Title: GEN000000-AIX0230
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000032 |
The information system enforces information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows. |
Controls
Number | Title |
---|---|
AC-4 (8) |
Security Policy Filters |