TCP Time stamp Vulnerability issue

[maruthu777]

Hello Everyone, 

I am using Huawei firewall and windows server 2012 R2 operating system in our environment, When we do vulnerability scanning through Nexpose scanner, It shows TCP time stamp vulnerability. When i try to disable in OS level, But cannot. Also Hauwei firewall also cannot solve TCP Timestamp Vulnerability. So we wish to change firewall to CISCO ASA 5525X.

Before changing, Whether CISCO firewall can solve TCP timestamp issue? 

Thanks

Maruthu

[Pranay Prasoon]

Hi,

Do you have any vulnerability CVE ID? It will be very difficult to predict a solution with this info.

Although, for the RFC 1323 Timestamp leak, you can disable the timestamps.
You will find the instructions below.

Cisco ASA 5500 Series Configuration Guide using the CLI, 8.2
 http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpnorm.html

Remote service implements TCP timestamps
 https://supportforums.cisco.com/discussion/11015136/remote-service-implements-tcp-timestamps

[maruthu777]

Hi Prasoon,

Thanks for the reply. I do not have any CVE ID, but we did vulnerability scanning through rapid 7 nexpose. vulnerability report say that RFC 1323 timestamp.

[Pranay Prasoon]

Well that's very generic. I guess above two links should help you.

[Ravi Singh]

Please check if you add the Tcp1323Opts registry key as follows:

Tcp1323Opts

Key: Tcpip\Parameters

Value Type: REG_DWORD—number (flags)

Valid Range: 0 or 2

0 (disable the use of the TCP timestamps option)
2 (enable the use of the TCP timestamps option)

Default: No value.

Description: This value controls the use of the RFC 1323 TCP Timestamp option. The default behavior of the TCP/IP stack is to not use the Timestamp options when initiating TCP connections, but use them if the TCP peer that is initiating communication includes them in their synchronize (SYN) segment.

For more information about TCP/IP Registry Values, you could access this link:

http://download.microsoft.com/download/c/2/6/c26893a6-46c7-4b5c-b287-830216597340/tcpip_reg.doc

Hope this helps.