The application server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-57501	SRG-APP-000142-AS-000014	SV-71777r2_rule		Medium

Description
Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoD ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html.

Description

Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoD ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html.

STIG	Date
Application Server Security Requirements Guide	2018-09-13

Details

Check Text ( C-58209r1_chk )
Review the application server documentation and deployment configuration to determine which ports and protocols are enabled. Verify that the ports and protocols being used are not prohibited and are necessary for the operation of the application server and the hosted applications. If any of the ports or protocols is prohibited or not necessary for the application server operation, this is a finding.

Check Text ( C-58209r1_chk )

Review the application server documentation and deployment configuration to determine which ports and protocols are enabled.

Verify that the ports and protocols being used are not prohibited and are necessary for the operation of the application server and the hosted applications.

If any of the ports or protocols is prohibited or not necessary for the application server operation, this is a finding.

Fix Text (F-62569r1_fix)
Configure the application server to disable any ports or protocols that are prohibited by the PPSM CAL and vulnerability assessments.