topic SPLAT R75.40 - disable TCP / ICMP timestamp in General Topics

SPLAT R75.40 - disable TCP / ICMP timestamp

Stefano_Chiesa — Thu, 25 Oct 2018 09:14:36 GMT

We were under audit and one of the finding is a TCP and ICMP timestamp response vulnerability/risk. The auditors recommend to turn TCP and ICMP timestamp off.

Does someone know how to do it and if there will be some "side effects"?

Thanks in advance.

Stefano.

Re: SPLAT R75.40 - disable TCP / ICMP timestamp

Danny — Thu, 25 Oct 2018 12:01:39 GMT

HI Stefano,

you can find all timestamp services via the integrated search function of your SmartDashboard:

You've probably allowed icmp pings by permitting the entire icmp protocol suite, including timestamps:

Just replace icmp-proto with echo-request like this:

I wonder why your internal audit didn't note that R75.40 is a version that went out of support in April 2016. You should consider upgrading to a more recent release, such as R77.30 or higher.

Re: SPLAT R75.40 - disable TCP / ICMP timestamp

Stefano_Chiesa — Thu, 25 Oct 2018 12:06:19 GMT

Hi Danny, thanks for the greetings.

Re: SPLAT R75.40 - disable TCP / ICMP timestamp

Stefano_Chiesa — Thu, 25 Oct 2018 14:12:32 GMT

Thanks a lot Danny, I'll try this solution.

Let me say that the most up-to-date clusters are R75.40 but there is a R65 HFA 70 cluster in production too..

Thanks again.

Stefano.

Re: SPLAT R75.40 - disable TCP / ICMP timestamp

HeikoAnkenbrand — Thu, 25 Oct 2018 17:29:02 GMT

Hi Stefano,

I do a lot of security audits at our company. I think the timstamp problem is the smallest.

The following vulnerabilities should occur with R65HFA 70 and possibly R75.40:

- SHA1 vulnerabilities

- RC4 vulnerabilities

- poodle vulnerabilitys

and and and

I agree with Danny here. I should urgently upgrade the systems to R77.30 or higher.

Regards

Heiko

Re: SPLAT R75.40 - disable TCP / ICMP timestamp

Itri — Mon, 01 Jul 2024 06:47:41 GMT

Hi. Any idea how to disable the same but on MDS smart center or log server, for local vulnerability scanner, where there is no firewall in between?
Edit: Have also some Eventia Reporter servers with same "issue", for which I can not even open smart console directly.

Re: SPLAT R75.40 - disable TCP / ICMP timestamp

PhoneBoy — Mon, 01 Jul 2024 18:50:41 GMT

That requires disabling them at the OS level.
For TCP timestamps: sysctl -w net.ipv4.tcp_timestamps=0
For ICMP, I'm not sure it's relevant or not and would recommend engaging TAC: https://help.checkpoint.com