Search filters the loaded rule list locally. Separate terms must all match (use quotes for an exact phrase).
Objective ID
Severity
Discussion
medium
Enabling the audit system will produce records with accurate time stamps, source, user, and activity information. Without this information malicious activity cannot be accurately tracked.
medium
Without an audit reporting capability, users find it difficult to identify specific patterns of attack.
medium
Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
Without accurate time stamps, source, user, and activity information, malicious activity cannot be accurately tracked.
Without an audit reduction and reporting capability, users find it difficult to identify specific patterns of attack.
medium
Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
Without accurate time stamps, source, user, and activity information, malicious activity cannot be accurately tracked.
Without an audit reduction and reporting capability, users find it difficult to identify specific patterns of attack.
medium
Without proper system auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
medium
Without accurate time stamps malicious activity cannot be accurately tracked.
medium
Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
Without accurate time stamps, source, user, and activity information, malicious activity cannot be accurately tracked.
Without an audit reduction and reporting capability, users find it difficult to identify specific patterns of attack.
medium
Without accurate source information malicious activity cannot be accurately tracked.
medium
Tracking both the successful and unsuccessful attempts aids in identifying threats to the system.
high
Proper alerts to system administrators and IA officials of audit failures ensure a timely response to critical system issues.
medium
If the startup files are writable by other users, these users could modify the startup files to insert malicious commands into the startup files.
medium
System start-up files not owned by root could lead to system compromise by allowing malicious users or applications to modify them for unauthorized purposes. This could lead to system and network compromise.
medium
If system start-up files do not have a group owner of root or a system group, the files may be modified by malicious users or intruders.
medium
.Xauthority files ensure the user is authorized to access the specific X Windows host. Excessive permissions may permit unauthorized modification of these files, which could lead to Denial of Service to authorized access or allow unauthorized access to be obtained.
medium
Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks.
Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password is, the lower the number of possible combinations that need to be tested before the password is compromised.
Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.
medium
To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.
medium
Complex passwords can reduce the likelihood of success of automated password-guessing attacks.
medium
Complex passwords can reduce the likelihood of success of automated password-guessing attacks.
medium
Complex passwords can reduce the likelihood of success of automated password-guessing attacks.
medium
Complex passwords can reduce the likelihood of success of automated password-guessing attacks.
low
Complex passwords can reduce the likelihood of success of automated password-guessing attacks.
medium
Complex passwords can reduce the likelihood of success of automated password-guessing attacks.
medium
Cryptographic hashes provide quick password authentication while not actually storing the password.
medium
Allowing continued access to accounts on the system exposes them to brute-force password-guessing attacks.
medium
As an immediate return of an error message, coupled with the capability to try again, may facilitate automatic and rapid-fire brute-force password attacks by a malicious user.
medium
Allowing access to a graphical environment when the user is not attending the system can allow unauthorized users access to the system.
medium
Allowing access to a graphical environment when the user is not attending the system can allow unauthorized users access to the system.
medium
Allowing any user to elevate their privileges can allow them excessive control of the system tools.
medium
Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions.
low
Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions.
medium
Login services should not be enabled on any serial ports that are not strictly required to support the mission of the system. This action can be safely performed even when console access is provided using a serial port.
medium
If login by the user "nobody" is allowed for secure RPC, there is an increased risk of system compromise. If keyserv holds a private key for the "nobody" user, it will be used by key_encryptsession to compute a magic phrase which can be easily recovered by a malicious user.
medium
As enabling X11 Forwarding on the host can permit a malicious user to secretly open another X11 connection to another remote client during the session and perform unobtrusive activities such as keystroke monitoring, if the X11 services are not required for the system's intended function, they should be disabled or restricted as appropriate to the user's needs.
medium
Setting this parameter forces users to enter a password when authenticating with SSH.
medium
The system should not allow users to log in as the root user directly, as audited actions would be non-attributable to a specific user.
low
This requirement applies to both internal and external networks.
Terminating network connections associated with communications sessions means de-allocating associated TCP/IP address/port pairs at the operating system level.
The time period of inactivity may, as the organization deems necessary, be a set of time periods by type of network access or for specific accesses.
medium
The use of .rhosts authentication is an insecure protocol and can be replaced with public-key authentication using Secure Shell. As automatic authentication settings in the .rhosts files can provide a malicious user with sensitive system credentials, the use of .rhosts files should be disabled.
medium
FTP is an insecure protocol that transfers files and credentials in clear text, and can be replaced by using SFTP. However, if FTP is permitted for use in the environment, it is important to ensure that the default "system" accounts are not permitted to transfer files via FTP, especially the root role. Consider also adding the names of other privileged or shared accounts that may exist on the system such as user "oracle" and the account which the web server process runs under.
high
As automatic logins are a known security risk for other than "kiosk" types of systems, GNOME automatic login should be disabled in pam.conf.
medium
Use an authorized mechanism such as RBAC and the "su" command to provide administrative access to unprivileged accounts. These mechanisms provide an audit trail in the event of problems.
low
Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the date and time of their last successful login allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.
medium
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the system but does not log out because of the temporary nature of the absence.
The session lock will also include an obfuscation of the display screen to prevent other users from reading what was previously displayed.
high
If the password field is blank and the system does not enforce a policy that passwords are required, it could allow login without proper authentication of a user.
medium
Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network.
The operating system needs to ensure all sessions and network connections are terminated when nonlocal maintenance is completed.
medium
Group-writable or world-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges.
medium
.netrc files may contain unencrypted passwords that can be used to attack other systems.
high
Even though the .rhosts files are ineffective if support is disabled in /etc/pam.conf, they may have been brought over from other systems and could contain information useful to an attacker for those other systems.
medium
Groups defined in passwd but not in group file pose a threat to system security since group permissions are not properly managed.
low
All users must be assigned a home directory in the passwd file. Failure to have a home directory may result in the user being put in the root directory.
medium
If a user is assigned a UID that is in the reserved range, even if it is not presently in use, security exposures can arise if a subsequently installed application uses the same UID.
medium
The .netrc file presents a significant security risk since it stores passwords in unencrypted form.
medium
Use of the .forward file poses a security risk in that sensitive data may be inadvertently transferred outside the organization. The .forward file also poses a secondary risk as it can be used to execute commands that may perform unintended actions.
medium
All accounts with a GID of 0 have root group privileges and must be limited to the group account only.
low
Proper file permissions and ownership ensures that only designated personnel in the organization can access error messages.
high
An operating system release is considered supported if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.
Release Released Premier Support Extended Support
11 09 Nov 2011 NA NA
11.1 03 Oct 2012 NA NA
11.2 29 Apr 2014 NA NA
11.3 26 Oct 2015 01 Jan 2021 01 Jan 2027
11.4 28 Aug 2018 01 Nov 2031 01 Nov 2037
low
The flexibility that GRUB provides creates a security risk if its configuration is modified by an unauthorized user. The failsafe menu entry needs to be secured in the same environments that require securing the systems firmware to avoid unauthorized removable media boots.
medium
Recovery and reconstitution constitutes executing an operating system contingency plan comprised of activities to restore essential missions and business functions.
Transaction rollback and transaction journaling are examples of mechanisms supporting transaction recovery.
While this is typically a database function, operating systems could be transactional in nature with respect to file processing.
low
Solaris zones can be assigned privileges generally reserved for the global zone using the "limitpriv" zone option. Any privilege assignments in excess of the vendor defaults may provide the ability for a non-global zone to compromise the global zone.
medium
Mobile devices include portable storage media (e.g., USB memory sticks, external hard disk drives) and portable computing and communications devices with information storage capability (e.g., notebook/laptop computers, personal digital assistants, cellular telephones, digital cameras, audio recording devices).
Organization-controlled mobile devices include those devices for which the organization has the authority to specify and the ability to enforce specific security requirements.
Usage restrictions and implementation guidance related to mobile devices include configuration management, device identification and authentication, implementation of mandatory protective software (e.g., malicious code detection, firewall), scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware (e.g., wireless, infrared).
In order to detect unauthorized mobile device connections, organizations must first identify and document what mobile devices are authorized.
medium
Using the audit system will utilize the audit reduction capability. Without an audit reduction capability, users find it difficult to identify specific patterns of attack.
medium
Enabling the audit system will produce records for use in report generation. Without an audit reporting capability, users find it difficult to identify specific patterns of attack.
medium
Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
Without accurate time stamps, source, user, and activity information, malicious activity cannot be accurately tracked.
Without an audit reduction and reporting capability, users find it difficult to identify specific patterns of attack.
medium
Filling the audit storage area can result in a denial of service or system outage and can lead to events going undetected.
high
Proper alerts to system administrators and Information Assurance (IA) officials of audit failures ensure a timely response to critical system issues.
medium
Mobile devices include portable storage media (e.g., USB memory sticks, external hard disk drives) and portable computing and communications devices with information storage capability (e.g., notebook/laptop computers, personal digital assistants, cellular telephones, digital cameras, audio recording devices).
Auto execution vulnerabilities can result in malicious programs being automatically executed. Examples of information system functionality providing the capability for automatic execution of code are Auto Run and Auto Play. Auto Run and Auto Play are components of the Microsoft Windows operating system that dictate what actions the system takes when a drive is mounted. This requirement is designed to address vulnerabilities that arise when mobile devices such as USB memory sticks or other mobile storage devices are automatically mounted and applications are automatically invoked without user knowledge or acceptance.
medium
Allowing any user to elevate their privileges can allow them excessive control of the system tools.