Detections
Analytics
VCUI-67-000029 - vSphere UI must disable the shutdown port - server.xml
Information
An attacker has at least two reasons to stop a web server. The first is to cause a denial of service, and the second is to put in place changes the attacker made to the web server configuration. If the Tomcat shutdown port feature is enabled, a shutdown signal can be sent to vSphere UI through this port. To ensure availability, the shutdown port must be disabled.Solution
Navigate to and open /usr/lib/vmware-vsphere-ui/server/conf/server.xml.Make sure that the server port is disabled:
<Server port='${shutdown.port}' ...>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 6.7 UI Tomcat v1r3
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-5, CAT|II, CCI|CCI-002385, Rule-ID|SV-239710r879806_rule, STIG-ID|VCUI-67-000029, Vuln-ID|V-239710
Plugin: Unix
Control ID: d5a6b18752540a1de6cdd205c664e4faa3e6627fe7b741a38838978a6f417675