The system package management tool must not automatically obtain updates.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22589	GEN008820	SV-26264r1_rule	ECSC-1	Low

Description
System package management tools can obtain a list of updates and patches from a package repository and make this information available to the SA for review and action. Using a package repository outside of the organization's control, presents a risk that malicious packages could be introduced.

STIG	Date
SOLARIS 9 X86 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2015-10-01

Details

Check Text ( C-29324r1_chk )
Determine if the system package management tool is configured to automatically obtain updated packages. If it is, this is a finding.

Fix Text (F-26356r1_fix)
Configure the system package management tool not to automatically obtain updates.