Detections
Analytics

VCPF-80-000034 The vCenter Perfcharts service must limit privileges for creating or modifying hosted application shared files.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Application servers have the ability to specify that the hosted applications use shared libraries. The application server must have a capability to divide roles based upon duties wherein one project user (such as a developer) cannot modify the shared library code of another project user. The application server must also be able to specify that nonprivileged users cannot modify any shared library code at all.

Ensuring the Security Lifecycle Listener element is uncommented and sets a minimum Umask value will allow the server to perform a number of security checks when starting and prevent the service from starting if they fail.

Solution

Navigate to and open:

/usr/lib/vmware-perfcharts/tc-instance/conf/server.xml

Navigate to the <Server> node and add or update the "org.apache.catalina.security.SecurityListener" as follows:

<Listener className="org.apache.catalina.security.SecurityListener"/>

Restart the service with the following command:

# vmon-cli --restart perfcharts

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y24M08_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001499, Rule-ID|SV-259076r960960_rule, STIG-ID|VCPF-80-000034, Vuln-ID|V-259076

Plugin: Unix

Control ID: 3ee6d200e627a651dce7ca6f337bcf01033e6988269ed6de0d86db72ab8ac743