SV-38452r1: The root account must not have world-writable directories in its executable search path. | HP-UX 11.23 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The root account must not have world-writable directories in its executable search path.

Description

Discussion Text

If the root search path contains a world-writable directory, malicious software could be placed in the path by intruders and/or malicious users and inadvertently run by root with all of root's privileges.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

Additional Details

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

References

DPMS Target HP-UX 11.23 DISA DPMS Target HP-UX 11.23 2170

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.hpux11:def:52
export PATH=$(getconf PATH)
for dir in $PATH; do
    if [ -d "$dir" ] && [ -w "$dir" ] && [ $(stat -c "%a" "$dir" | awk '{print $1}') -eq 0 ] && [ $(stat -c "%A" "$dir" | grep -o 'w+' | wc -c) -gt 0 ]; then
        echo "FAIL"
        exit 1
    fi
done
echo "PASS"
exit 0

Remediation

For each world-writable path in root's executable search path, do one of the following:

1. Remove the world-writable permission on the directory.
Procedure:
# chmod o-w <path>

2. Remove the world-writable directory from the executable search path.
Procedure:
Identify and edit the initialization file referencing the world-writable directory and remove it from the PATH variable.