topic Hi Prasoon, in Network Security

TCP Time stamp Vulnerability issue

maruthu777 — Sun, 10 Mar 2019 13:44:16 GMT

Hello Everyone,

I am using Huawei firewall and windows server 2012 R2 operating system in our environment, When we do vulnerability scanning through Nexpose scanner, It shows TCP time stamp vulnerability. When i try to disable in OS level, But cannot. Also Hauwei firewall also cannot solve TCP Timestamp Vulnerability. So we wish to change firewall to CISCO ASA 5525X.

Before changing, Whether CISCO firewall can solve TCP timestamp issue?

Thanks

Maruthu

Hi,

Pranay Prasoon — Thu, 22 Dec 2016 04:49:15 GMT

Hi,

Do you have any vulnerability CVE ID? It will be very difficult to predict a solution with this info.

Although, for the RFC 1323 Timestamp leak, you can disable the timestamps.
You will find the instructions below.

Cisco ASA 5500 Series Configuration Guide using the CLI, 8.2
 http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpnorm.html

Remote service implements TCP timestamps
 https://supportforums.cisco.com/discussion/11015136/remote-service-implements-tcp-timestamps

Hi Prasoon,

maruthu777 — Thu, 22 Dec 2016 05:53:21 GMT

Hi Prasoon,

Thanks for the reply. I do not have any CVE ID, but we did vulnerability scanning through rapid 7 nexpose. vulnerability report say that RFC 1323 timestamp.

Well that's very generic. I

Pranay Prasoon — Thu, 22 Dec 2016 06:48:51 GMT

Well that's very generic. I guess above two links should help you.

Please check if you add the

Ravi Singh — Thu, 22 Dec 2016 08:51:04 GMT

Please check if you add the Tcp1323Opts registry key as follows:

Tcp1323Opts

Key: Tcpip\Parameters

Value Type: REG_DWORD—number (flags)

Valid Range: 0 or 2

0 (disable the use of the TCP timestamps option)
2 (enable the use of the TCP timestamps option)

Default: No value.

Description: This value controls the use of the RFC 1323 TCP Timestamp option. The default behavior of the TCP/IP stack is to not use the Timestamp options when initiating TCP connections, but use them if the TCP peer that is initiating communication includes them in their synchronize (SYN) segment.

For more information about TCP/IP Registry Values, you could access this link:

http://download.microsoft.com/download/c/2/6/c26893a6-46c7-4b5c-b287-830216597340/tcpip_reg.doc

Hope this helps.