Sophos Client Firewall: security implications of configuring ICMP

The ICMP tabbed page in the Firewall Policy editor in Enterprise Console, and the Sophos Client Firewall Configuration Editor on the local computer, is used by the Sophos Client Firewall to define permissions for incoming and outgoing ICMP traffic. A knowledgebase article lists the default settings for this page (among others).

A separate knowledgebase article outlines the security implications of configuration options for the Sophos Client Firewall.

ICMP tabbed page

ICMP traffic for incoming and outgoing communications is enabled separately.

• Echo Reply
  Used to reply to echo requests (pings). Enabling Echo Reply could make your computer vulnerable to smurf attacks.
• Destination Unreachable
  Enabling this option could make your computer vulnerable to a destination unreachable attack.
• Source Quench
  To manage overload, source quench messages request that the amount of information sent to the message originator is reduced. Enabling Source Quench could make your computer vulnerable to man in the middle attacks and Denial of Service (DoS) attacks.
• Redirect
  Redirection can be used to change the routing tables on routers and computers in order to facilitate a DoS attack.
• Echo Request
  Used to ascertain if a networked computer is active (e.g. ping). Enabling Echo Request could make your computer vulnerable to smurf attacks.
• Router Advertisement
  Router advertisement messages are sent in response to router solicitation messages, or to broadcast the presence of the router. Spoofed router advertisement messages can be used to change routing tables within routers so as to facilitate man in the middle and DoS attacks.
• Router Solicitation
  Router solicitation messages are sent to locate routers within a network as a form of network scanning. Malicious users can use router solicitation to search for computers to attack.

The following options have no current security vulnerability associated with them:

• Time Exceeded for a Datagram
• Parameter Problem for a Datagram
• Timestamp Request
• Timestamp Reply
• Information Request
• Information Reply
• Address Mask Request
• Address Mask Reply

Other Sophos Client Firewall pages

Further knowledgebase articles describe the security implications of changing other options:

• General, LAN and Logs
• Global Rules
• Applications
• Processes