UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must ignore IPv4 ICMP redirect messages.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22416 GEN003609 SV-26630r2_rule Medium
Description
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
STIG Date
Solaris 10 SPARC Security Technical Implementation Guide 2019-06-24

Details

Check Text ( C-27667r2_chk )
Determine the type of zone that you are currently securing.
# zonename

If the zone is not the global zone, determine if any interfaces are exclusive to the zone:
# dladm show-link

If the output indicates "insufficient privileges" then this requirement is not applicable.

If the zone is the global zone or the non-global zone has exclusive interfaces verify the system does not accept IPv4 ICMP redirect messages.

Procedure:
# ndd -get /dev/ip ip_ignore_redirect

If the result is not 1, this is a finding.
Fix Text (F-23873r1_fix)
Configure the system to not accept IPv4 ICMP redirect messages.

Procedure:
# ndd -set /dev/ip ip_ignore_redirect 1

This command must also be added to a system startup script.