Setuid bit must be removed from Apple Remote Desktop.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-25283 | OSX00215 M6 | SV-38223r1_rule | ECCD-1 ECCD-2 | Medium |
| Description |
|---|
| Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. |
| STIG | Date |
|---|---|
| MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft | 2013-01-10 |
Details
| Check Text ( C-37687r1_chk ) |
|---|
| Open a terminal session and enter the following command. ls -la /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent Verify the file permissions are set to 755 or more restrictive. If not, this is a finding. |
| Fix Text (F-32930r1_fix) |
|---|
| Open a terminal session and enter the following command. chmod 755 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent |