Java Runtime Environment (JRE) 6 STIG for Windows XP

Overview

Version	Date	Finding Count (11)			Downloads
1	2014-10-05 2013-07-25 2013-07-25 2013-07-25 2014-04-04 2014-04-04	CAT I (High): 1	CAT II (Med): 10	CAT III (Low): 0	Excel	JSON	XML

STIG Description
The Java Runtime Environment (JRE) is a bundle developed and offered by Oracle Corporation which includes the Java Virtual Machine (JVM), class libraries, and other components necessary to run Java applications and applets. Certain default settings within the JRE pose a security risk so it is necessary to deploy system wide properties to ensure a higher degree of security when utilizing the JRE. Guidance placed on sunset list 10/24/2014. XP OS no longer supported by vendor.

STIG Description

The Java Runtime Environment (JRE) is a bundle developed and offered by Oracle Corporation which includes the Java Virtual Machine (JVM), class libraries, and other components necessary to run Java applications and applets. Certain default settings within the JRE pose a security risk so it is necessary to deploy system wide properties to ensure a higher degree of security when utilizing the JRE. Guidance placed on sunset list 10/24/2014. XP OS no longer supported by vendor.

Available Profiles

Classified	Public	Sensitive
I - Mission Critical Classified	I - Mission Critical Public	I - Mission Critical Sensitive	II - Mission Support Classified	II - Mission Support Public	II - Mission Support Sensitive	III - Administrative Classified	III - Administrative Public	III - Administrative Sensitive

Findings (MAC III - Administrative Sensitive)

Finding ID	Severity	Title	Description
V-54383	High	The Java Runtime Environment (JRE) must not be installed on an unsupported operating system.	Security updates are the standard method for addressing discovered vulnerabilities. The operating system platform the JRE is installed on must be supported for security updates or the OS becomes...
V-32829	Medium	The dialog enabling users to grant permissions to execute signed content from an un-trusted authority must be locked.	Java applets exist in both signed and unsigned forms. Although signed applets allow for authentication of the author in order to establish trust, even signed applets can potentially contain...
V-32828	Medium	The dialog enabling users to grant permissions to execute signed content from an un-trusted authority must be disabled.	Java applets exist in both signed and unsigned forms. Although signed applets allow for authentication of the author in order to establish trust, even signed applets can potentially contain...
V-32902	Medium	A properties file must be present to hold all the keys that establish properties within the Java control panel.	The deployment.properties file is used for specifying keys for the Java Runtime Environment. Each option in the Java control panel is represented by property keys. These keys adjust the options...
V-32833	Medium	The option to enable online certificate validation must be locked.	Online certificate validation provides a real-time option to validate a certificate. When enabled, if a certificate is presented, the status of the certificate is requested. The status is sent...
V-32830	Medium	The dialog to enable users to check publisher certificates for revocation must be enabled.	A certificate revocation list is a directory which contains a list of certificates that have been revoked for various reasons. Certificates may be revoked due to improper issuance, compromise of...
V-32831	Medium	The option to enable users to check publisher certificates for revocation must be locked.	Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found revoked on a CRL or via Online Certificate...
V-32832	Medium	The option to enable online certificate validation must be enabled.	Online certificate validation provides a real-time option to validate a certificate. When enabled, if a certificate is presented, the status of the certificate is requested. The status is sent...
V-32842	Medium	The configuration file must contain proper keys and values to deploy settings correctly.	The deployment.config file is used to specify the location of the deployment.properties file and for controlling the launch of the JRE runtime. By default, these two files do not exist, they must...
V-39239	Medium	The version of the JRE running on the system must be the most current available.	The JRE is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the JRE can introduce security vulnerabilities to the system.
V-32901	Medium	A configuration file must be present to deploy properties for JRE.	The deployment.config file is used for specifying the location and execution of system-level properties for the Java Runtime Environment. By default no deployment.config file exists; thus, no...