STIGQter STIGQter: STIG Summary: Windows Server 2008 R2 Member Server Security Technical Implementation Guide Version: 1 Release: 30 Benchmark Date: 26 Jul 2019: IPv6 source routing will be configured to highest protection.

DISA Rule

SV-32449r1_rule

Vulnerability Number

V-21955

Group Title

IPv6 Source Routing

Rule Version

3.155

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)” to “Highest protection, source routing is completely disabled”.

Check Contents

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for “MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)” is not set to “Highest protection, source routing is completely disabled”, then this is a finding.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \System\CurrentControlSet\Services\Tcpip6\Parameters\

Value Name: DisableIpSourceRouting

Type: REG_DWORD
Value: 2

Vulnerability Number

V-21955

Documentable

False

Rule Version

3.155

Severity Override Guidance

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for “MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)” is not set to “Highest protection, source routing is completely disabled”, then this is a finding.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \System\CurrentControlSet\Services\Tcpip6\Parameters\

Value Name: DisableIpSourceRouting

Type: REG_DWORD
Value: 2

Check Content Reference

M

Responsibility

System Administrator

Target Key

1823

Comments