{"description": "The Datagram Congestion Control Protocol (DCCP) is a\nrelatively new transport layer protocol, designed to support\nstreaming media and telephony.\n\nTo configure the system to prevent the dccp\nkernel module from being loaded, add the following line to the file /etc/modprobe.d/dccp.conf:\n
install dccp /bin/false
\nThis entry will cause a non-zero return value during a dccp module installation\nand additionally convey the meaning of the entry to the user in form of an error message.\nIf you would like to omit a non-zero return value and an error message, you may want to add a different line instead\n(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):\n
install dccp /bin/true
", "rationale": "Disabling DCCP protects\nthe system against exploitation of any flaws in its implementation.", "severity": "medium", "references": {"cis-csc": ["11", "14", "3", "9"], "cjis": ["5.10.1"], "cobit5": ["BAI10.01", "BAI10.02", "BAI10.03", "BAI10.05", "DSS05.02", "DSS05.05", "DSS06.06"], "cui": ["3.4.6"], "isa-62443-2009": ["4.3.3.5.1", "4.3.3.5.2", "4.3.3.5.3", "4.3.3.5.4", "4.3.3.5.5", "4.3.3.5.6", "4.3.3.5.7", "4.3.3.5.8", "4.3.3.6.1", "4.3.3.6.2", "4.3.3.6.3", "4.3.3.6.4", "4.3.3.6.5", "4.3.3.6.6", "4.3.3.6.7", "4.3.3.6.8", "4.3.3.6.9", "4.3.3.7.1", "4.3.3.7.2", "4.3.3.7.3", "4.3.3.7.4", "4.3.4.3.2", "4.3.4.3.3"], "isa-62443-2013": ["SR 1.1", "SR 1.10", "SR 1.11", "SR 1.12", "SR 1.13", "SR 1.2", "SR 1.3", "SR 1.4", "SR 1.5", "SR 1.6", "SR 1.7", "SR 1.8", "SR 1.9", "SR 2.1", "SR 2.2", "SR 2.3", "SR 2.4", "SR 2.5", "SR 2.6", "SR 2.7", "SR 7.6"], "iso27001-2013": ["A.12.1.2", "A.12.5.1", "A.12.6.2", "A.14.2.2", "A.14.2.3", "A.14.2.4", "A.9.1.2"], "nist": ["CM-7(a)", "CM-7(b)", "CM-6(a)"], "nist-csf": ["PR.IP-1", "PR.PT-3"], "pcidss": ["Req-1.4.2"], "srg": ["SRG-OS-000096-GPOS-00050", "SRG-OS-000378-GPOS-00163"], "cis": ["3.2.1"], "pcidss4": ["1.4.2", "1.4"]}, "control_references": {"cis": ["3.2.1"], "pcidss4": ["1.4.2", "1.4"]}, "components": [], "identifiers": {}, "ocil_clause": "no line is returned", "ocil": "\nIf the system is configured to prevent the loading of the dccp kernel module,\nit will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.\nThese lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.\n\nRun the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:\n
$ grep -r dccp /etc/modprobe.conf /etc/modprobe.d
", "oval_external_content": null, "fixtext": "Configure Ubuntu 22.04 to disable the Datagram Congestion Control Protocol (DCCP).\n\nTo configure the system to prevent the dccp\nkernel module from being loaded, add the following line to the file /etc/modprobe.d/dccp.conf:\n
install dccp /bin/false
\nThis entry will cause a non-zero return value during a dccp module installation\nand additionally convey the meaning of the entry to the user in form of an error message.\nIf you would like to omit a non-zero return value and an error message, you may want to add a different line instead\n(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):\n
install dccp /bin/true
", "checktext": "", "vuldiscussion": "", "srg_requirement": " The kernel module dccp must be disabled in Ubuntu 22.04.", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Disable DCCP Support", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/network/network-uncommon/kernel_module_dccp_disabled/rule.yml", "template": {"name": "kernel_module_disabled", "vars": {"kernmodule": "dccp"}, "backends": {}}}