Detections
Analytics

2.2 Alter the Advertised server.number String

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The server.number attribute represents the specific version of Tomcat that is executing. This value is presented to Tomcat clients when connect.

 NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Perform the following to alter the server number string that gets displayed when clients connect to the tomcat server.
 1. Extract the ServerInfo.properties file from the catalina.jar file:
 $ cd $CATALINA_HOME/lib
 $ jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties
 2. Navigate to the util directory that was created
 cd org/apache/catalina/util
 3. Open ServerInfo.properties in an editor
 4. Update the server.info attribute in the ServerInfo.properties file.
 server.number=<SomeNumber>
 5. Update the catalina.jar with the modified ServerInfo.properties file.
 $ jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties

See Also

https://workbench.cisecurity.org/files/267

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-30

Plugin: Unix

Control ID: 1a0136fb42b77e20c2ef1faad4bfa24cf050392039f7ac2f804f2c0992654f98