UCF STIG Viewer Logo

The version of the OHS installation must be vendor-supported.


Overview

Finding ID Version Rule ID IA Controls Severity
V-64661 OH12-1X-000211 SV-79151r1_rule High
Description
Many vulnerabilities are associated with older versions of software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining OHS at a current version makes the efforts of a malicious user to exploit the web service more difficult.
STIG Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide 2015-12-10

Details

Check Text ( C-65403r1_chk )
1. Obtain the version of the OHS 12c software (e.g., grep Oracle-HTTP-Server-12c $DOMAIN_HOME/servers//logs/ohs1.log). Confirm it is 12.1.3.

2. Refer to the support date schedule for "Fusion Middleware 12c (12.1.x)" at http://www.oracle.com/us/support/library/lifetime-support-middleware-069163.pdf. Confirm that support remains available and that the organization is current with respect to payments.

3. If not, this is a finding.
Fix Text (F-70591r1_fix)
1. Install or upgrade to a version of OHS that is within the support timeframes for "Fusion Middleware 12c" at http://www.oracle.com/us/support/library/lifetime-support-middleware-069163.pdf.

2. Confirm that the organization is current with respect to support payments.