Title

The system must not respond to ICMP timestamp requests. (Cat III impact)

Discussion

By accurately determining the system's clock state, an attacker can more effectively attack certain time-based pseudorandom number generators (PRNGs) and the authentication systems that rely on them.

Check Content

Determine if ICMP time stamp responses are disabled. # ipadm show-prop -p _respond_to_timestamp -co current ip If the output of both commands is not "0", this is a finding.

Fix Text

The Network Management profile is required. Disable source respond to timestamp. # pfexec ipadm set-prop -p _respond_to_timestamp=0 ip

Additional Identifiers

Rule ID: SV-216369r959010_rule

Vulnerability ID: V-216369

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.