STIGQter STIGQter: STIG Summary: Solaris 11 X86 Security Technical Implementation Guide Version: 1 Release: 20 Benchmark Date: 24 Jan 2020: The system must disable ICMP redirect messages.

DISA Rule

SV-61069r3_rule

Vulnerability Number

V-48197

Group Title

SRG-OS-999999

Rule Version

SOL-11.1-050090

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

The Network Management profile is required.

If the version of Solaris is earlier than Solaris 11.2, disable send redirects for IPv4 and IPv6.

# pfexec ipadm set-prop -p _send_redirects=0 ipv4
# pfexec ipadm set-prop -p _send_redirects=0 ipv6

If the version of Solaris is Solaris 11.2 or later, disable send redirects for IPv4 and IPv6.

# pfexec ipadm set-prop -p send_redirects=off ipv4
# pfexec ipadm set-prop -p send_redirects=off ipv6

Check Contents

Determine the version of Solaris 11 in use.

# cat /etc/release

If the version of Solaris is earlier than Solaris 11.2, determine if ICMP redirect messages are disabled.

# ipadm show-prop -p _send_redirects -co current ipv4
# ipadm show-prop -p _send_redirects -co current ipv6

If the output of all commands is not "0", this is a finding.

If the version of Solaris is Solaris 11.2 or later, determine if ICMP redirect messages are disabled.

# ipadm show-prop -p send_redirects -co current ipv4
# ipadm show-prop -p send_redirects -co current ipv6

If the output of all commands is not "off", this is a finding.

Vulnerability Number

V-48197

Documentable

False

Rule Version

SOL-11.1-050090

Severity Override Guidance

Determine the version of Solaris 11 in use.

# cat /etc/release

If the version of Solaris is earlier than Solaris 11.2, determine if ICMP redirect messages are disabled.

# ipadm show-prop -p _send_redirects -co current ipv4
# ipadm show-prop -p _send_redirects -co current ipv6

If the output of all commands is not "0", this is a finding.

If the version of Solaris is Solaris 11.2 or later, determine if ICMP redirect messages are disabled.

# ipadm show-prop -p send_redirects -co current ipv4
# ipadm show-prop -p send_redirects -co current ipv6

If the output of all commands is not "off", this is a finding.

Check Content Reference

M

Target Key

2108

Comments