[PTCH 1/28] Housekeeping of OVAL references

Shawn Wells shawn.d.wells at gmail.com
Fri Dec 14 02:49:21 UTC 2012


-------------- next part --------------
>From 5b69c93d2bb4fd62e87c2ee93236d261a1c6ac72 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 13 Dec 2012 19:44:16 -0500
Subject: [PATCH 01/28] Housekeeping of OVAL references
 These rules didn't actually have OVAL counterparts, moving them "TODO"

---
 RHEL6/input/services/http.xml               |    8 ++++----
 RHEL6/input/services/nfs.xml                |   16 ++++++++--------
 RHEL6/input/system/accounts/banners.xml     |    2 +-
 RHEL6/input/system/logging.xml              |    2 +-
 RHEL6/input/system/permissions/mounting.xml |    2 +-
 5 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/RHEL6/input/services/http.xml b/RHEL6/input/services/http.xml
index d1f396b..02fca5c 100644
--- a/RHEL6/input/services/http.xml
+++ b/RHEL6/input/services/http.xml
@@ -120,7 +120,7 @@ Information disclosed to clients about the configuration of the web server and s
 to plan an attack on the given system. This information disclosure should be restricted to a minimum.
 </rationale>
 <ident cce="4474-3" />
-<oval id="httpd_servertokens_prod" />
+<oval id="TODO" />
 <ref nist="CM-6, CM-7" disa="1124" />
 </Rule>
 
@@ -138,7 +138,7 @@ Information disclosed to clients about the configuration of the web server and s
 to plan an attack on the given system. This information disclosure should be restricted to a minimum.
 </rationale>
 <ident cce="3756-4" />
-<oval id="httpd_serversignature_off" />
+<oval id="TODO" />
 <ref nist="CM-6, CM-7" disa="1124" />
 </Rule>
 
@@ -648,7 +648,7 @@ content is transmitted in plain text which could be passively monitored and acce
 unauthorized parties.
 </rationale>
 <!--<ident cce="3756-4" />-->
-<oval id="package_mod_ssl_installed" />
+<oval id="TODO" />
 <!--<ref nist="CM-6, CM-7" />-->
 </Rule>
 
@@ -679,7 +679,7 @@ enabling the administrator to implement content access policies and filters at t
 application layer.
 </rationale>
 <!--<ident cce="3756-4" />-->
-<oval id="package_mod_security_installed" />
+<oval id="TODO" />
 <!--<ref nist="CM-6, CM-7" />-->
 </Rule>
 
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index c67abd0..858aa9e 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -213,7 +213,7 @@ Restrict service to always use a given port, so that firewalling can be done
 effectively.
 </rationale>
 <ident cce="4559-1" />
-<oval id="nfs_fixed_lockd_tcp_port" />
+<oval id="TODO" />
 </Rule>
 
 <Rule id="nfs_fixed_lockd_udp_port">
@@ -230,7 +230,7 @@ your network.
 Restrict service to always use a given port, so that firewalling can be done effectively.
 </rationale>
 <ident cce="4310-9" />
-<oval id="nfs_fixed_lockd_udp_port" />
+<oval id="TODO" />
 </Rule>
 
 <Rule id="nfs_fixed_statd_port">
@@ -245,7 +245,7 @@ Where <tt>statd-port</tt> is a port which is not used by any other service on yo
 Restrict service to always use a given port, so that firewalling can be done effectively.
 </rationale>
 <ident cce="3667-3" />
-<oval id="nfs_fixed_statd_port" />
+<oval id="TODO" />
 </Rule>
 
 <Rule id="nfs_fixed_mountd_port">
@@ -260,7 +260,7 @@ Where <tt>mountd-port</tt> is a port which is not used by any other service on y
 Restrict service to always use a given port, so that firewalling can be done effectively.
 </rationale>
 <ident cce="4438-8" />
-<oval id="nfs_fixed_mountd_port" />
+<oval id="TODO" />
 </Rule>
 
 </Group> <!-- <Group id="nfs_configure_fixed_ports"> -->
@@ -451,7 +451,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>no_root_squ
 <rationale>If the NFS server allows root access to local file systems from remote hosts, this
 access could be used to compromise the system.</rationale>
 <ident cce="4544-3" />
-<oval id="TO:DO" />
+<oval id="TODO" />
 </Rule>
 
 <Rule id="restrict_nfs_clients_to_privileged_ports">
@@ -467,7 +467,7 @@ Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>insecure</t
 user to initiate an NFS connection. If the unprivileged user account has been compromised, an
 attacker could gain access to data on the NFS server.</rationale>
 <ident cce="4465-1" />
-<oval id="TO:DO" />
+<oval id="TODO" />
 </Rule>
 
 <Rule id="no_insecure_locks_exports" severity="medium">
@@ -490,8 +490,8 @@ To verify insecure file locking has been disabled, run the following command.
 <rationale>Allowing insecure file locking could allow for sensitive data to be
 viewed or edited by an unauthorized user.
 </rationale>
-<ident cce="TO:DO" />
-<oval id="TO:DO" />
+<ident cce="TODO" />
+<oval id="TODO" />
 <ref disa="764" />
 </Rule>
 
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml
index 4961b15..e4f886c 100644
--- a/RHEL6/input/system/accounts/banners.xml
+++ b/RHEL6/input/system/accounts/banners.xml
@@ -143,7 +143,7 @@ Although unlikely to dissuade a serious attacker, the warning message
 reinforces policy awareness during the logon process.
 </rationale>
 <ident cce="4188-9" />
-<oval id="banner_gui_text_set" value="login_banner_text" />
+<oval id="TODO" value="login_banner_text" />
 <ref nist="AC-3, CM-6, AC-8" disa="48,1384,1385,1386,1387,1388" />
 </Rule>
 
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index ff08cb8..aa987d1 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -439,6 +439,6 @@ If so:
 If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central 
 logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier 
 and less time-intensive for administrators.</description>
-<oval id="logwatch_disabled_for_logserver" />
+<oval id="TODO" />
 </Rule>
 </Group>
diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml
index 5c60da7..e4f3b15 100644
--- a/RHEL6/input/system/permissions/mounting.xml
+++ b/RHEL6/input/system/permissions/mounting.xml
@@ -301,7 +301,7 @@ file to exploit this flaw. Assuming the attacker could place the malicious file
 malicious file would exploit the thumbnailer with the potential for malicious code execution. It
 is best to disable these thumbnailer applications unless they are explicitly required.</rationale>
 <ident cce="TODO" />
-<oval id="disable_gnome_thumbnailers" />
+<oval id="TODO" />
 <ref nist="CM-6, CM-7" />
 </Rule>
 
-- 
1.7.1



More information about the scap-security-guide mailing list