The system must provide protection from Internet Control Message Protocol (ICMP) attacks on TCP connections.

From AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE

Associated with IA controls: ECSC-1

Associated with: CCI-000032

SV-38700r1_rule The system must provide protection from Internet Control Message Protocol (ICMP) attacks on TCP connections.

Vulnerability discussion

The ICMP attacks may be of the form of ICMP source quench attacks and Path MTU Discovery (PMTUD) attacks. If this network option tcp_icmpsecure is turned on, the system does not react to ICMP source quench messages. This will protect against ICMP source quench attacks. The payload of the ICMP message is tested to determine if the sequence number of the TCP header portion of the payload is within the range of acceptable sequence numbers. This will mitigate PMTUD attacks to a large extent.

Check content

Check the value of the tcp_icmpsecure parameter. # /usr/sbin/no -o tcp_icmpsecure If the value returned is not 1, this is a finding.

Fix text

Set the tcp_icmpsecure parameter to 1. # /usr/sbin/no -p -o tcp_icmpsecure=1

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.