Title

The system must not respond to ICMPv6 echo requests sent to a broadcast address. (Cat II impact)

Discussion

Responding to broadcast ICMP echo requests facilitates network mapping and provides a vector for amplification attacks.

Check Content

Check for an ip6tables rule that drops inbound IPv6 ICMP ECHO_REQUESTs sent to the all-hosts multicast address. Procedure: # less /etc/sysconfig/scripts/SuSEfirewall2-custom Check for a rule in, or referenced by, the INPUT chain such as: ip6tables -A INPUT -p icmpv6 -d ff02::1 --icmpv6-type 128 -j DROP If such a rule does not exist, this is a finding.

Fix Text

Add an ip6tables rule that drops inbound IPv6 ICMP ECHO_REQUESTs sent to the all-hosts multicast address. Edit /etc/sysconfig/scripts/SuSEfirewall2-custom and add a rule in, or referenced by, the INPUT chain such as: ip6tables -A INPUT -p icmpv6 -d ff02::1 --icmpv6-type 128 -j DROP Reload the SuSEfirewall2 rules. Procedure: # rcSuSEfirewall2 restart

Additional Identifiers

Rule ID: SV-45993r1_rule

Vulnerability ID: V-23972

Group Title: GEN007950

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.