The mobile operating system must not accept certificate revocation information without verifying its authenticity.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-32992 | SRG-OS-000066-MOS-000040 | SV-43390r1_rule | Low |
| Description |
|---|
| If the operating system does not verify the authenticity of revocation information, there is the potential that an authorized system is providing false information. Acceptance of the false information could result in the installation of unauthorized software or connection to rogue networks, depending on the use for which the certificate is intended. Verifying the authenticity of revocation information mitigates this risk. |
| STIG | Date |
|---|---|
| Mobile Operating System Security Requirements Guide | 2013-07-03 |
Details
| Check Text ( C-41289r1_chk ) |
|---|
| Inspect the mobile operating system configuration to not accept certificate revocation information without verifying its authenticity. The system should be able to detect that the revocation status information is not authentic. If the mobile operating system does not verify the authenticity of revocation information, this is a finding. |
| Fix Text (F-36904r1_fix) |
|---|
| Configure the operating system to not accept certificate revocation information without verifying its authenticity. |