Title

TCP data retransmissions are not controlled. (Cat III impact)

Discussion

In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and no longer is able to respond to legitimate requests.

Check Content

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is the default)” is not set to “3” or less, this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: TcpMaxDataRetransmissions Value Type: REG_DWORD Value: 3

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is the default)” to “3” or less.

Additional Identifiers

Rule ID: SV-4438r1_rule

Vulnerability ID: V-4438

Group Title: TCP Data Retransmissions

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.