Title

The system must not respond to ICMP broadcast timestamp requests. (Cat III impact)

Discussion

By accurately determining the system's clock state, an attacker can more effectively attack certain time-based pseudorandom number generators (PRNGs) and the authentication systems that rely on them.

Check Content

Determine if response to ICMP broadcast timestamp requests is disabled. # ipadm show-prop -p _respond_to_timestamp_broadcast -co current ip If the output of this command is not "0", this is a finding.

Fix Text

The Network Management profile is required. Disable respond to timestamp broadcasts. # pfexec ipadm set-prop -p _respond_to_timestamp_broadcast=0 ip

Additional Identifiers

Rule ID: SV-216370r603267_rule

Vulnerability ID: V-216370

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.