The system must disable ICMP redirect messages.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-216139 | SOL-11.1-050090 | SV-216139r959010_rule | CCI-000366 | low |
| Description | ||||
| A malicious user can exploit the ability of the system to send ICMP redirects by continually sending packets to the system, forcing the system to respond with ICMP redirect messages, resulting in an adverse impact on the CPU performance of the system. | ||||
| STIG | Date | |||
| Solaris 11 X86 Security Technical Implementation Guide | 2025-05-05 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-216139r959010_chk)
Determine the version of Solaris 11 in use.
# cat /etc/release
If the version of Solaris is earlier than Solaris 11.2, determine if ICMP redirect messages are disabled.
# ipadm show-prop -p _send_redirects -co current ipv4
# ipadm show-prop -p _send_redirects -co current ipv6
If the output of all commands is not "0", this is a finding.
If the version of Solaris is Solaris 11.2 or later, determine if ICMP redirect messages are disabled.
# ipadm show-prop -p send_redirects -co current ipv4
# ipadm show-prop -p send_redirects -co current ipv6
If the output of all commands is not "off", this is a finding.
Fix Text (F-17375r372800_fix)
The Network Management profile is required.
If the version of Solaris is earlier than Solaris 11.2, disable send redirects for IPv4 and IPv6.
# pfexec ipadm set-prop -p _send_redirects=0 ipv4
# pfexec ipadm set-prop -p _send_redirects=0 ipv6
If the version of Solaris is Solaris 11.2 or later, disable send redirects for IPv4 and IPv6.
# pfexec ipadm set-prop -p send_redirects=off ipv4
# pfexec ipadm set-prop -p send_redirects=off ipv6