The IAO/NSO will ensure IPv6 addresses with embedded IPv4-compatible IPv6 addresses are blocked on the ingress and egress filters, (0::/96).

From Perimeter Router Security Technical Implementation Guide Juniper

Part of Embedded IPv4-Compatible IPv6 ADDR are not blocked

SV-15412r1_rule The IAO/NSO will ensure IPv6 addresses with embedded IPv4-compatible IPv6 addresses are blocked on the ingress and egress filters, (0::/96).

Vulnerability discussion

The IPv6 transition mechanisms include a technique for hosts and routers to dynamically tunnel IPv6 packets over IPv4 routing infrastructure. IPv6 nodes that use this technique are assigned special IPv6 unicast addresses that carry a global IPv4 address in the low-order 32 bits. IPv4-compatible IPv6 addresses should never appear as a source or destination address. These addresses begin with 0000 and have ‘0000’ in the 16 bit field preceding the IPv4 address. RFC 4291 deprecated the IPv4-compatible addresses.

Check content

[edit interfaces] fe-2/0/10 { description "to NIPRNet core router"; speed 100m; link-mode full-duplex; unit 0 { family inet6 { filter { input ingress-filter; } address 2001:db8:60::f14b:65a1/64; } } } [edit firewall] family inet6 { filter ingress-filter { term term-1 { from { address { 0::/96; } } then discard; } }

Fix text

The administrator will configure the router ACLs to restrict IP addresses that contain any embedded IPv4-compatible IPv6 addresses.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.