Detections
Analytics

5.4.2.5 Ensure root path integrity

Information

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly.

Including the current working directory (.) or other writable directory in root 's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program.

Solution

Correct or justify any:

 - Locations that are not directories
 - Empty directories ( :: )
 - Trailing ( : )
 - Current working directory ( . )
 - Non root owned directories
 - Directories that less restrictive than mode 0755

See Also

https://workbench.cisecurity.org/benchmarks/18211

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: 9d6d593757f566c99e223a7557299f208428cd823132a5dfe5c458c28976c504