net.ipv4.conf.all.mc_forwarding CVE-2016-5696

charly78 · 08-13-2016, 06:03 PM

Recent exploit patching I am having some trouble and my question is how can I change the value of

Code:

# echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >>/etc/sysctl.conf;sysctl -p
sysctl: permission denied on key 'net.ipv4.tcp_challenge_ack_limit'

http://cve.mitre.org/cgi-bin/cvename...=CVE-2016-5696

For Debian users
https://security-tracker.debian.org/.../CVE-2016-5696

I used nano to edit but when I try to load the configuration file in /etc/sysctl.conf

Code:

sysctl -p
sysctl: permission denied on key 'net.ipv4.tcp_challenge_ack_limit'

I rebooted I am not sure how to check if it has taken the configuration how to check and how to make it take the change?

Emerson · 08-13-2016, 06:11 PM

Try this (no spaces):

Code:

sysctl -w net.ipv4.tcp_challenge_ack_limit=999999999

charly78 · 08-13-2016, 08:50 PM

Code:

~# sysctl -w net.ipv4.tcp_challenge_ack_limit=999999999
sysctl: permission denied on key 'net.ipv4.tcp_challenge_ack_limit'

charly78 · 08-13-2016, 08:54 PM

oh wait hang on a second.. i forgot this is actually openvz urg I guess I need to do this on the main metal hardware part...

Emerson · 08-13-2016, 08:57 PM

Is this a hardened box?

charly78 · 08-13-2016, 09:00 PM

ok on the hardware node looks like it took. thanks for your help. forgot it was a openvz container

Code:

# echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >>/etc/sysctl.conf;sysctl -p
kernel.sysrq = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.default.forwarding = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.tcp_challenge_ack_limit = 999999999

charly78 · 08-13-2016, 09:10 PM

maybe you could be more specific?

Quote:

Originally Posted by Emerson

Is this a hardened box?

ihaveavirus · 08-15-2016, 12:15 PM

Quote:

Originally Posted by charly78

maybe you could be more specific?

I think the poster was asking if system had been locked down (reducing common security risks) since you were receiving permission denied errors. Also, its best practice to test kernel parameter changes in the run time environment first, before committing them to the system.