DISA_STIG_McAfee_VSEL_1.9.x_2.0.x_Local_Client_v1r6.audit from DISA McAfee VSEL 1.9/2.0 Local Client v1r6 STIG

DTAVSEL-000 - The McAfee VirusScan Enterprise for Linux  Web interface must be disabled unless the system is on a segregated network.

800-53|CM-5(1)

CAT|II

CCI|CCI-001813

Rule-ID|SV-77281r1_rule

STIG-ID|DTAVSEL-000

Vuln-ID|V-62791

DTAVSEL-001 - The anti-virus signature file age must not exceed 7 days - avvclean.dat

800-53|SI-3b.

CAT|I

CCI|CCI-001240

Rule-ID|SV-77561r1_rule

STIG-ID|DTAVSEL-001

Vuln-ID|V-63071

DTAVSEL-001 - The anti-virus signature file age must not exceed 7 days - avvnames.dat

DTAVSEL-001 - The anti-virus signature file age must not exceed 7 days - avvscan.dat

DTAVSEL-002 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x must be configured to receive automatic updates.

Rule-ID|SV-77563r1_rule

STIG-ID|DTAVSEL-002

Vuln-ID|V-63073

DTAVSEL-003 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x must be configured to enable On-Access scanning.

800-53|SI-3c.2.

CCI|CCI-001243

Rule-ID|SV-77565r1_rule

STIG-ID|DTAVSEL-003

Vuln-ID|V-63075

DTAVSEL-004 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to decompress archives when scanning.

Rule-ID|SV-77567r1_rule

STIG-ID|DTAVSEL-004

Vuln-ID|V-63077

DTAVSEL-005 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to find unknown program viruses.

Rule-ID|SV-77569r1_rule

STIG-ID|DTAVSEL-005

Vuln-ID|V-63079

DTAVSEL-006 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to find unknown macro viruses.

Rule-ID|SV-77571r1_rule

STIG-ID|DTAVSEL-006

Vuln-ID|V-63081

DTAVSEL-007 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to find potentially unwanted programs.

Rule-ID|SV-77573r1_rule

STIG-ID|DTAVSEL-007

Vuln-ID|V-63083

DTAVSEL-008 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to scan files when being written to disk.

Rule-ID|SV-77575r1_rule

STIG-ID|DTAVSEL-008

Vuln-ID|V-63085

DTAVSEL-009 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to scan files when being read from disk.

Rule-ID|SV-77577r1_rule

STIG-ID|DTAVSEL-009

Vuln-ID|V-63087

DTAVSEL-010 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to scan all file types.

Rule-ID|SV-77579r1_rule

STIG-ID|DTAVSEL-010

Vuln-ID|V-63089

DTAVSEL-011 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner maximum scan time must not be less than 45 seconds - default.scanMaxTmo

Rule-ID|SV-77581r1_rule

STIG-ID|DTAVSEL-011

Vuln-ID|V-63091

DTAVSEL-011 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner maximum scan time must not be less than 45 seconds - scanMaxTmo

DTAVSEL-012 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must only be configured with exclusions that are documented and approved by the ISSO/ISSM/AO.

Rule-ID|SV-77583r1_rule

STIG-ID|DTAVSEL-012

Vuln-ID|V-63093

DTAVSEL-013 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to Clean as first action when a virus or Trojan is detected.

Rule-ID|SV-77585r2_rule

STIG-ID|DTAVSEL-013

Vuln-ID|V-63095

DTAVSEL-014 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to Quarantine if first action fails when a virus or Trojan is detected.

Rule-ID|SV-77587r2_rule

STIG-ID|DTAVSEL-014

Vuln-ID|V-63097

DTAVSEL-015 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to Clean as first action when programs and jokes are found.

Rule-ID|SV-77589r2_rule

STIG-ID|DTAVSEL-015

Vuln-ID|V-63099

DTAVSEL-016 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to Quarantine if first action fails when programs and jokes are found.

Rule-ID|SV-77591r2_rule

STIG-ID|DTAVSEL-016

Vuln-ID|V-63101

DTAVSEL-017 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to deny access to the file if an error occurs during scanning.

Rule-ID|SV-77593r2_rule

STIG-ID|DTAVSEL-017

Vuln-ID|V-63103

DTAVSEL-018 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be configured to allow access to files if scanning times out.

Rule-ID|SV-77595r2_rule

STIG-ID|DTAVSEL-018

Vuln-ID|V-63105

DTAVSEL-019 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be enabled to scan mounted volumes when mounted volumes point to a network server without an anti-virus solution installed.

800-53|SI-3c.1.

CCI|CCI-001242

Rule-ID|SV-77597r1_rule

STIG-ID|DTAVSEL-019

Vuln-ID|V-63107

DTAVSEL-100 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x must be configured to run a scheduled On-Demand scan at least once a week.

CCI|CCI-001241

Rule-ID|SV-77599r1_rule

STIG-ID|DTAVSEL-100

Vuln-ID|V-63109

DTAVSEL-101 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to decompress archives when scanning.

Rule-ID|SV-77601r1_rule

STIG-ID|DTAVSEL-101

Vuln-ID|V-63111

DTAVSEL-102 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to find unknown program viruses.

Rule-ID|SV-77603r1_rule

STIG-ID|DTAVSEL-102

Vuln-ID|V-63113

DTAVSEL-103 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to find unknown macro viruses.

Rule-ID|SV-77605r1_rule

STIG-ID|DTAVSEL-103

Vuln-ID|V-63115

DTAVSEL-104 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to find potentially unwanted programs.

Rule-ID|SV-77607r1_rule

STIG-ID|DTAVSEL-104

Vuln-ID|V-63117

DTAVSEL-105 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to scan all file types.

Rule-ID|SV-77609r1_rule

STIG-ID|DTAVSEL-105

Vuln-ID|V-63119

DTAVSEL-106 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to Clean infected files automatically as first action when a virus or Trojan is detected.

Rule-ID|SV-77611r1_rule

STIG-ID|DTAVSEL-106

Vuln-ID|V-63121

DTAVSEL-107 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to Move infected files to the quarantine directory if first action fails when a virus or Trojan is detected.

Rule-ID|SV-77613r1_rule

STIG-ID|DTAVSEL-107

Vuln-ID|V-63123

DTAVSEL-108 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must only be configured with exclusions that are documented and approved by the ISSO/ISSM/AO.

Rule-ID|SV-77615r1_rule

STIG-ID|DTAVSEL-108

Vuln-ID|V-63125

DTAVSEL-110 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to Clean infected files automatically as first action when programs and jokes are found.

Rule-ID|SV-77617r1_rule

STIG-ID|DTAVSEL-110

Vuln-ID|V-63127

DTAVSEL-111 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to Move infected files to the quarantine directory if first action fails when programs and jokes are found.

Rule-ID|SV-77619r1_rule

STIG-ID|DTAVSEL-111

Vuln-ID|V-63129

DTAVSEL-112 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to decode MIME encoded files.

Rule-ID|SV-77621r1_rule

STIG-ID|DTAVSEL-112

Vuln-ID|V-63131

DTAVSEL-113 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to include all local drives and their sub-directories.

Rule-ID|SV-77623r2_rule

STIG-ID|DTAVSEL-113

Vuln-ID|V-63133

DTAVSEL-200 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x must scan all media used for system maintenance prior to use.

800-53|MA-3(2)

CCI|CCI-000870

Rule-ID|SV-77627r1_rule

STIG-ID|DTAVSEL-200

Vuln-ID|V-63137

DTAVSEL-201 - The McAfee VirusScan Enterprise must be configured to receive all patches, service packs and updates from a DoD-managed source.

800-53|CM-5(3)

CCI|CCI-001749

Rule-ID|SV-77629r1_rule

STIG-ID|DTAVSEL-201

Vuln-ID|V-63139

DTAVSEL-202 - The nails user and nailsgroup group must be restricted to the least privilege access required for the intended role - group

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-77631r1_rule

STIG-ID|DTAVSEL-202

Vuln-ID|V-63141

DTAVSEL-202 - The nails user and nailsgroup group must be restricted to the least privilege access required for the intended role - user

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - includeOdsTasks

Rule-ID|SV-77633r2_rule

STIG-ID|DTAVSEL-205

Vuln-ID|V-63143

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - jokesAlert

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - programsAlert

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - SMTP host

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - SMTP port

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - SMTP recipients

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - SMTP sender

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - trojansAlert

DTAVSEL-205 - A notification mechanism or process must be in place to notify Administrators of out of date DAT, detected malware and error codes - VirusDetected

DTAVSEL-301 - Access to the McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x Web UI must be enforced by firewall rules.

Detections

Analytics

Revision 1.7

Apr 12, 2023

Miscellaneous

Added