STIGQter STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 1 Release: 26 Benchmark Date: 24 Jan 2020: The system must prevent local applications from generating source-routed packets.

DISA Rule

SV-29709r1_rule

Vulnerability Number

V-22413

Group Title

GEN003606

Rule Version

GEN003606

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Edit /etc/ipf/ipf.conf and add rules to block outgoing source-routed packets, such as:

block out log quick all with opt lsrr
block out log quick all with opt ssrr

Reload the IPF rules.
Procedure:

# ipf -Fa -A -f /etc/ipf/ipf.conf

Check Contents

Check the system for an IPF rule blocking outgoing source-routed packets.

Procedure:
# ipfstat -o

Examine the list for rules such as:
block out log quick all with opt lsrr
block out log quick all with opt ssrr

If the listed rules do not block both lsrr and ssrr options, this is a finding.

Vulnerability Number

V-22413

Documentable

False

Rule Version

GEN003606

Severity Override Guidance

Check the system for an IPF rule blocking outgoing source-routed packets.

Procedure:
# ipfstat -o

Examine the list for rules such as:
block out log quick all with opt lsrr
block out log quick all with opt ssrr

If the listed rules do not block both lsrr and ssrr options, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

25

Comments