Error: ICMP timestamp Type 13 or 14 observed on vCenter Server or Aria Operations for Logs

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Security scanners may flag CVE-1999-0524 indicating that remote hosts answer to ICMP timestamp requests (Type 13) and provide timestamp replies (Type 14). This occurs when:

• Scanning appliances with a third-party vulnerability scanner.
• Directly pinging the appliance using ICMP Type 13.
• Custom firewall rules are configured to "Accept" all traffic, overriding default drop rules.

Symptoms

• Vulnerability report identifies CVE-1999-0524.
• Appliance responds to nping or ping requests with timestamp data.

Environment

• VMware Aria Operations for Logs 8.x

Cause

ICMP timestamp Type 13 requests and Type 14 responses are normally dropped by default iptables rules. This behavior is overridden if a custom firewall rule is set to "Accept" instead of "Return" or if the default drop rules are missing from the configuration.

Resolution

1. Log in to the appliance as root via SSH.
2. Verify the current ICMP drop rules:
   In a bash shell, run:

   iptables -L INPUT -v | grep icmp

3. If rules are missing, add the drop rules for timestamp requests and replies:
   In a bash shell, run:

   iptables -I INPUT -p icmp --icmp-type timestamp-request -j DROP 
   iptables -I OUTPUT -p icmp --icmp-type timestamp-reply -j DROP

4. Save the iptables configuration to ensure persistence after reboot:
   • For vCenter: Firewall changes should be managed via the VAMI (Port 5480) by setting the Action policy to "Return" rather than "Accept".
   • For Aria Operations for Logs:
     In a bash shell, run:

     iptables-save > /etc/systemd/scripts/ip4save
     systemctl restart iptables

5. To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.

Additional Information

For more details on CVE-1999-0524, see the NVD - CVE-1999-0524 Detail. Users are recommended to subscribe to this article for future updates.