Disable ICMP timestamp response

ISMS

Audit Report

CVE-1999-0524

3.3.11. ICMP timestamp response (generic-icmp-timestamp)

The remote host responded to an ICMP timestamp request. The ICMP timestamp response contains the remote host's date and time. This information could theoretically be used against some systems to exploit weak time-based random number generators in other services.

In addition, the versions of some operating systems can be accurately fingerprinted by analyzing their responses to invalid ICMP timestamp requests.

• Solution:

Disable ICMP timestamp responses

Disable ICMP timestamp replies for the device. If the device does not support this level of configuration, the easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response).

• Command(windows):

netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block

netsh advfirewall firewall add rule name="Block Type 14 ICMP V4" protocol=icmpv4:14,any dir=in action=block

netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=out action=block

netsh advfirewall firewall add rule name="Block Type 14 ICMP V4" protocol=icmpv4:14,any dir=out action=block