Title

IPv6 must be disabled until a deliberate transition strategy has been implemented. Use of IPv6 transition technologies must be disabled. (Cat II impact)

Discussion

Any nodes’ interface with IPv6 enabled by default presents a potential risk of traffic being transmitted or received without proper risk mitigation strategy and is therefore, a serious security concern.

Check Content

Prior to transition, IPv6 must be disabled on all interfaces. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisabledComponents Type: REG_DWORD Value: 0xff or 0xffffffff If IPv6 transition has been implemented, the following will disable tunnel interfaces allowing native IPv6. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisabledComponents Type: REG_DWORD Value: 0x1 Microsoft updated article 929852 with regard to disabling all IPv6 components, changing the value to 0xff. A value of 0xffffffff results in a 5-second delay in system startup. However, either value can be used to disable all IPv6 components. Documentable: If disabling IPv6 on all interfaces prior to the transition to supporting IPv6 causes issues with necessary applications or services, document this with the IAO.

Fix Text

Add the following registry values to the system. To disable IPv6 on all interfaces: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisabledComponents Type: REG_DWORD Value: 0xff or 0xffffffff To disable all IPv6 tunneling interfaces: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisabledComponents Type: REG_DWORD Value: 0x1 Microsoft updated article 929852 with regard to disabling all IPv6 components, changing the value to 0xff. A value of 0xffffffff results in a 5-second delay in system startup. However, either value can be used to disable all IPv6 components.

Additional Identifiers

Rule ID: SV-14873r3_rule

Vulnerability ID: V-14262

Group Title: IPv6 Transition

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.