Internet Control Message Types (ICMP) must be blocked outbound to external untrusted networks (e.g., ISP and other non-DoD networks).

From Perimeter Router Security Technical Implementation Guide Juniper

Part of Outbound ICMP messages are not blocked.

Associated with IA controls: ECSC-1

SV-15369r2_rule Internet Control Message Types (ICMP) must be blocked outbound to external untrusted networks (e.g., ISP and other non-DoD networks).

Vulnerability discussion

Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Techniques, such as host detection, service detection, network topology mapping, and operating system fingerprinting are often used. The data collected will be used to identify those hosts running network services, which may have a known vulnerability. This vulnerability may allow the malicious attacker to exploit vulnerabilities in the network or gain unauthorized access to those systems. This unauthorized access may become the focal point to the whole targeted network.

Check content

Review ACLs configured on network devices connected to untrusted networks (e.g., ISP and other non-DoD networks) are blocking outbound ICMP messages. The following are exceptions are allowed outbound. Exceptions: ICMP messages Packet-too-Big (type 3, code 4) Source Quench (type 4) Echo Request (type 8) If ICMP messages are not blocked outbound, this is a finding. JUNOS Example: [edit interfaces] fe-2/0/10 { description "downstream link to our network”; unit 0 { family inet { filter { input egress-filter; } address 10.0.0.1/24; } } } } [edit firewall] family inet { filter egress-filter { term icmp-out-good { from { source-address { 10.0.0.0/24; } protocol icmp; icmp-type [ echo-request source-quench ]; } then { accept; } } term icmp-out-bad { from { protocol icmp; } then { syslog; discard; } } } }

Fix text

Configure ACLs on network devices to block outbound ICMP messages. Exceptions to this rule are listed below. Exceptions: ICMP messages Packet-too-Big (type 3, code 4) Source Quench (type 4) Echo Request (type 8)

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer