STIGQter STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The system must prevent local applications from generating source-routed packets.

DISA Rule

SV-227799r603266_rule

Vulnerability Number

V-227799

Group Title

SRG-OS-000480

Rule Version

GEN003606

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Edit /etc/ipf/ipf.conf and add rules to block outgoing source-routed packets, such as:

block out log quick all with opt lsrr
block out log quick all with opt ssrr

Reload the IPF rules.
Procedure:

# ipf -Fa -A -f /etc/ipf/ipf.conf

Check Contents

Check the system for an IPF rule blocking outgoing source-routed packets.

Procedure:
# ipfstat -o

Examine the list for rules such as:
block out log quick all with opt lsrr
block out log quick all with opt ssrr

If the listed rules do not block both lsrr and ssrr options, this is a finding.

Vulnerability Number

V-227799

Documentable

False

Rule Version

GEN003606

Severity Override Guidance

Check the system for an IPF rule blocking outgoing source-routed packets.

Procedure:
# ipfstat -o

Examine the list for rules such as:
block out log quick all with opt lsrr
block out log quick all with opt ssrr

If the listed rules do not block both lsrr and ssrr options, this is a finding.

Check Content Reference

M

Target Key

4061

Comments