Title

The system must not respond to Internet Control Message Protocol (ICMP) timestamp requests sent to a broadcast address. (Cat II impact)

Discussion

The processing of (ICMP) timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.

Check Content

Verify the system does not respond to ICMP TIMESTAMP_REQUESTs set to broadcast addresses. Procedure: # cat /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts If the result is not 1, this is a finding. Note: The same parameter controls both ICMP ECHO_REQUESTs and TIMESTAMP_REQUESTs.

Fix Text

Configure the system to not respond to ICMP TIMESTAMP_REQUESTs sent to broadcast addresses. Edit /etc/sysctl.conf and add a setting for "net.ipv4.icmp_echo_ignore_broadcasts=1" and reload the sysctls. Procedure: # echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf # sysctl -p

Additional Identifiers

Rule ID: SV-45723r1_rule

Vulnerability ID: V-22411

Group Title: GEN003604

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.