The auditing tool, audit, must be the one provided by Apple, Inc.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-51457	OSX8-00-00410	SV-65667r1_rule		Medium

Description
The auditing tool, audit, should be the one provided by Apple, Inc.

STIG	Date
Apple OS X 10.8 (Mountain Lion) Workstation STIG	2015-02-10

Details

Check Text ( C-53797r1_chk )
Run the following command to ensure the audit tool, audit has the correct signed hash value: sudo codesign -dvvv /usr/sbin/audit 2>&1 | grep CDHash | sed 's/CDHash=//' The result should be "e23e7f63cdef9c1844390a3c8f32122b671b68d3". If it differs, this is a finding.

Fix Text (F-56259r1_fix)
If the check fails, you will need to obtain the correct files from the original 10.8 installation media.