The system package management tool must not automatically obtain updates.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-227987	GEN008820	SV-227987r603266_rule		Low

Description
System package management tools can obtain a list of updates and patches from a package repository and make this information available to the SA for review and action. Using a package repository outside of the organization's control, presents a risk that malicious packages could be introduced.

STIG	Date
Solaris 10 X86 Security Technical Implementation Guide	2020-12-04

Details

Check Text ( C-30149r490420_chk )
Determine if the system package management tool is configured to automatically obtain updated packages using the cron or at utilities. # grep smpatch /var/spool/cron/crontabs/* /var/spool/cron/atjobs/* If smpatch is called with the add, update, or remove subcommands, this is a finding.

Fix Text (F-30137r490421_fix)
Disable any cron or at jobs running smpatch. # crontab -e < user running smpatch > # atrm < id of at job running smpatch >