Detections
Analytics

5.4.2.5 Ensure root path integrity

Information

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly.

Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

Solution

Correct or justify any:

 - Locations that are not directories
 - Empty directories ( :: )
 - Trailing ( : )
 - Current working directory ( . )
 - Non root owned directories
 - Directories that less restrictive than mode 0755

Impact:

A compromised or misconfigured root PATH can cause the root user to inadvertently execute a trojan program placed in a world-writable directory - this is a classic privilege escalation vector.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: 0242c3e9a3ad5b5221eadfa8b42dd740d8175c695343ba80bc671cec2e99abc7