Detections
Analytics

1.2 VCLU-80-000005

Information

The vCenter Lookup service cookies must have secure flag set.

GROUP ID: V-259038RULE ID: SV-259038r960792

The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a cookie in clear text.

By setting the secure flag, the browser will prevent the transmission of a cookie over an unencrypted channel.

Solution

Navigate to and open:

/usr/lib/vmware-lookupsvc/conf/web.xml

Navigate to the node and configure the setting as follows:

Restart the service with the following command:

vmon-cli --restart lookupsvc

See Also

https://workbench.cisecurity.org/benchmarks/23617

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CAT|II, CCI|CCI-000213, Rule-ID|SV-259038r960792_rule, STIG-ID|VCLU-80-000005, Vuln-ID|V-259038

Plugin: Unix

Control ID: 0f9eacd17b3f7d7baccbcc016081170bead2eecfb65e5e08c4a0f87366b32e9c