Title

The system must use initial TCP sequence numbers most resistant to sequence number guessing attacks. (Cat II impact)

Discussion

One use of initial TCP sequence numbers is to verify bidirectional communication between two hosts, which provides some protection against spoofed source addresses being used by the connection originator. If the initial TCP sequence numbers for a host can be determined by an attacker, it may be possible to establish a TCP connection from a spoofed source address without bidirectional communication.

Check Content

# grep "TCP_STRONG_ISS=2" /etc/default/inetinit If this variable is not set, this is a finding.

Fix Text

Edit /etc/default/inetinit and set the TCP_STRONG_ISS parameter to 2.

Additional Identifiers

Rule ID: SV-226887r603265_rule

Vulnerability ID: V-226887

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.