The system must disable TCP reverse IP source routing.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-216140SOL-11.1-050100SV-216140r959010_ruleCCI-000366low
Description
If enabled, reverse IP source routing would allow an attacker to more easily complete a three-way TCP handshake and spoof new connections.
STIGDate
Solaris 11 X86 Security Technical Implementation Guide2025-05-05

Details

Check Text (C-216140r959010_chk)

Determine if TCP reverse IP source routing is disabled. # ipadm show-prop -p _rev_src_routes -co current tcp If the output of this command is not "0", this is a finding.

Fix Text (F-17376r372803_fix)

The Network Management profile is required. Disable reverse source routing. # pfexec ipadm set-prop -p _rev_src_routes=0 tcp