Check: GEN003609 M6
MACOSX 10.6:
GEN003609 M6
(in version v1 r3)
Title
The system must ignore IPv4 ICMP redirect messages. (Cat II impact)
Discussion
ICMP redirect messages are used by routers to inform hosts of a more direct route existing for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
Check Content
Open a terminal session and enter the following command to view the value of "net.inet.icmp.drop_redirect". sysctl -a | grep net.inet.icmp.drop_redirect If the value of "net.inet.icmp.drop_redirect" is not set to "0", this is a finding.
Fix Text
Open a terminal session and edit the /etc/sysctl.conf file and add the following line. net.inet.icmp.drop_redirect=0 NOTE: If the sysctl.conf file does not exist use the following command to create one. touch /etc/sysctl.conf
Additional Identifiers
Rule ID: SV-38204r1_rule
Vulnerability ID: V-22416
Group Title:
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001503 |
The organization controls changes to the configuration settings in accordance with organizational policies and procedures. |
| CCI-001551 |
The organization defines approved authorizations for controlling the flow of information between interconnected systems. |