The version of the OHS installation must be vendor-supported.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-64661	OH12-1X-000211	SV-79151r1_rule		High

Description
Many vulnerabilities are associated with older versions of software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining OHS at a current version makes the efforts of a malicious user to exploit the web service more difficult.

STIG	Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide	2020-06-12

Details

Check Text ( C-65403r1_chk )
1. Obtain the version of the OHS 12c software (e.g., grep Oracle-HTTP-Server-12c $DOMAIN_HOME/servers//logs/ohs1.log). Confirm it is 12.1.3. 2. Refer to the support date schedule for "Fusion Middleware 12c (12.1.x)" at http://www.oracle.com/us/support/library/lifetime-support-middleware-069163.pdf. Confirm that support remains available and that the organization is current with respect to payments. 3. If not, this is a finding.

Check Text ( C-65403r1_chk )

1. Obtain the version of the OHS 12c software (e.g., grep Oracle-HTTP-Server-12c $DOMAIN_HOME/servers//logs/ohs1.log). Confirm it is 12.1.3.

2. Refer to the support date schedule for "Fusion Middleware 12c (12.1.x)" at http://www.oracle.com/us/support/library/lifetime-support-middleware-069163.pdf. Confirm that support remains available and that the organization is current with respect to payments.

3. If not, this is a finding.

Fix Text (F-70591r1_fix)
1. Install or upgrade to a version of OHS that is within the support timeframes for "Fusion Middleware 12c" at http://www.oracle.com/us/support/library/lifetime-support-middleware-069163.pdf. 2. Confirm that the organization is current with respect to support payments.