0

We had a penetration test done on our servers and one of the vulnerabilities they suggested we fix is that the host responded to an ICMP timestamp request with TCP timestamp.

I've looked around but can't figure out how to disable it on our webserver or how to issue a command to check for this vulnerability (i.e. a ping or something).

It's IIS 7.5 on Windows Server 2008 R2. I read something about disabling it in Windows Firewall but that is disabled as we use Symantec Endpoint Protection.

Any ideas?

Thanks!

2 Answers 2

1

Normally Symantec Endpoint blocks this by default, and a more common request is to allow for the behavior instead of deny it.

At any rate, you can use the steps in this article.
Simply replace Allow Traffic with Disallow Traffic.

2
  • Is there a way to test if the request has been successfully blocked via command prompt or some other method?
    – Tom
    Dec 10, 2014 at 14:58
  • 1
    @tom There is a tool called SING that will allow you to send these requests.
    – Reaces
    Dec 10, 2014 at 15:01
0

I am Chetan Savade from Symantec Technical Support Team.

I would suggest to use customized policy provided by Symantec. Symantec has created a policy that can be import into the Symantec Endpoint Protection Manager (SEPM). This policy is very powerful and offers significant zero day protection against new threats.

Hardening Symantec Endpoint Protection with an Application and Device Control Policy to increase security

http://www.symantec.com/docs/TECH132337

Best Regards, Chetan

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .