GEN007860 - The system must ignore IPv6 ICMP redirect messages.

Information

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.

Solution

Configure the system to ignore IPv6 ICMP redirect messages.
# /usr/sbin/no -p -o ipignoreredirects=1

See Also

https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R14_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|II, CCI|CCI-001551, Group-ID|V-22550, Rule-ID|SV-38825r1_rule, STIG-ID|GEN007860, Vuln-ID|V-22550

Plugin: Unix

Control ID: 40552fe9918d36ae7a57d60db458a71357d530b300dc2728777883ec0134e531