The IPS must prevent the execution of prohibited mobile code.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000289-IDPS-000184	SRG-NET-000289-IDPS-000184	SRG-NET-000289-IDPS-000184_rule		Medium

Description
The mobile code paradigm encompasses programs that can be executed on one or several hosts other than the one they originate from. Mobility of such programs implies some built-in capability for each piece of code to travel smoothly from one host to another. Mobile code systems range from simple applets to intelligent software agents. These systems offer several advantages over the more traditional distributed computing approach. Decisions regarding the employment of mobile code within the IDPS are based on the potential for the code to cause damage to the system if used maliciously. Mobile code technologies include Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. IDPS must be configured to detect mobile code and prevent the affected traffic from reaching its intended destination and being executed.

Description

The mobile code paradigm encompasses programs that can be executed on one or several hosts other than the one they originate from. Mobility of such programs implies some built-in capability for each piece of code to travel smoothly from one host to another. Mobile code systems range from simple applets to intelligent software agents. These systems offer several advantages over the more traditional distributed computing approach. Decisions regarding the employment of mobile code within the IDPS are based on the potential for the code to cause damage to the system if used maliciously. Mobile code technologies include Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. IDPS must be configured to detect mobile code and prevent the affected traffic from reaching its intended destination and being executed.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43329_chk )
Verify signatures exist that monitor for prevent the execution of prohibited mobile code. If sensors are not configured to prevent the execution of mobile code, this is a finding.

Fix Text (F-43329_fix)
Install and configure signatures that monitor for and prevent the execution of prohibited mobile code.