Free DISA STIG and SRG Library | Vaulted

V-55351

The IDPS must, for fragmented packets, either block the packets or properly reassemble the packets before inspecting and forwarding.

Finding ID
SRG-NET-000401-IDPS-00203
Rule ID
SV-69597r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000401-IDPS-00203
CCI
CCI-001310
Target Key
(None)
Documentable
No
Discussion

Packet fragmentation is allowed by the TCP/IP specifications and is encouraged in situations where it is needed. However, packet fragmentation has been used to make some attacks harder to detect (by placing them within fragmented packets), and unusual fragmentation has also been used as a form of attack. For example, some network-based attacks have used packets that should not exist in normal communications, such as sending some fragments of a packet but not the first fragment, or sending packet fragments that overlap each other. These, and other types of packet fragmentation, aim to evade the IDPS. Since it is usually not possible to test this capability in a production environment, systems should either be validated in a testing environment or prior to installation. This requirement is usually a function of the design of the IDPS component. Compliance can be verified by acceptance/validation processes or vendor attestation.

Fix Text

Configure the IDPS to, for fragmented packets, either block the packets or properly reassemble the packets before inspecting and forwarding.

Check Content

Verify the IDPS, for fragmented packets, either blocks the packets or properly reassembles the packets before inspecting and forwarding. For fragmented packets, if the IDPS does not either block the packets or properly reassemble the packets before inspecting and forwarding, this is a finding.