GEN007940 - The system must not accept source-routed IPv6 packets.

Information

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the handling of source-routed traffic destined to the system itself, not to traffic forwarded by the system to another, such as when IPv6 forwarding is enabled and the system is functioning as a router.

Solution

Configure the system to not accept source-routed IPv6 packets.
# /usr/sbin/no -p -o ipsrcrouterecv=0

See Also

https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R13_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CAT|II, CCI|CCI-001551, Group-ID|V-22554, Rule-ID|SV-38828r1_rule, STIG-ID|GEN007940

Plugin: Unix

Control ID: 9e939f96c8f855ffddccab220a34da72fc1d7e91f777d42ddc004fcb15ccbd0a