Detections
Analytics

1.15 VCLU-80-000124

Information

The vCenter Lookup service must enable "STRICT_SERVLET_COMPLIANCE".

GROUP ID: V-259051RULE ID: SV-259051r961863

Strict Servlet Compliance forces Tomcat to adhere to standards specifications including but not limited to RFC2109. RFC2109 sets the standard for HTTP session management. This setting affects several other settings that primarily pertain to cookie headers, cookie values, and sessions. Cookies will be parsed for strict adherence to specifications.

Note that changing a number of these default settings may break some systems, as some browsers are unable to correctly handle the cookie headers that result from a strict adherence to the specifications.

This one setting changes the default values for the following settings:

org.apache.catalina.core.ApplicationContext.GET_RESOURCE_REQUIRE_SLASHorg.apache.catalina.core.ApplicationDispatcher.WRAP_SAME_OBJECTorg.apache.catalina.core.StandardHostValve.ACCESS_SESSIONorg.apache.catalina.session.StandardSession.ACTIVITY_CHECKorg.apache.catalina.session.StandardSession.LAST_ACCESS_AT_STARTorg.apache.tomcat.util.http.ServerCookie.ALWAYS_ADD_EXPIRESorg.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATORorg.apache.tomcat.util.http.ServerCookie.PRESERVE_COOKIE_HEADERorg.apache.tomcat.util.http.ServerCookie.STRICT_NAMINGThe "resourceOnlyServlets" attribute of any Context element.The "tldValidation" attribute of any Context element.The "useRelativeRedirects" attribute of any Context element.The "xmlNamespaceAware" attribute of any Context element.The "xmlValidation" attribute of any Context element.

Solution

Navigate to and open:

/usr/lib/vmware-lookupsvc/conf/catalina.properties

Add or change the following line:

org.apache.catalina.STRICT_SERVLET_COMPLIANCE=true

Restart the service with the following command:

vmon-cli --restart lookupsvc

See Also

https://workbench.cisecurity.org/benchmarks/23617

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-259051r961863_rule, STIG-ID|VCLU-80-000124, Vuln-ID|V-259051

Plugin: Unix

Control ID: 31210b39138d34be577556df7ac1be64d78c70b94ec850db58d6443134e689fe