Detections
Analytics

8.3 VMware Tools should configure automatic upgrades as appropriate for the environment

Information

Automatic upgrades of VMware Tools can be managed via vSphere, ensuring VMware Tools versions remain current. This functionality is advisable unless alternative management and update mechanisms are in place. It is recommended to have automatic updates enabled to minimize administrative overhead and maintain up-to-date features and security patches. The parameter governing this behavior is autoupgrade allow-upgrade with a recommended setting of true.

Enabling automatic upgrades via vSphere ensures a streamlined process for keeping VMware Tools updated, reducing the administrative burden. It also ensures that VMs are running the latest versions with necessary security patches and updated features.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate this recommendation, enable automatic VMware Tools upgrades only where appropriate, or configure a controlled centralized update process. In vSphere select the approved 'check and upgrade Tools during power cycling' behavior as appropriate for the environment.

Impact:

Disabling automatic upgrades necessitates alternative methods for updating and reconfiguring VMware Tools, which could increase administrative overhead and potentially leave VMs with outdated versions, posing security risks and operational inefficiencies.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.5

Plugin: VMware

Control ID: 7f2aaa6144f057b230ba5b73ee75ad56c285e03ac95bd77612be7455d558d58a