Any active TFTP daemon must be authorized and approved in the system accreditation package.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-4695 | GEN005140 | SV-4695r2_rule | DCSW-1 | High |
| Description |
|---|
| TFTP is a file transfer protocol often used by embedded systems to obtain configuration data or software. The service is unencrypted and does not require authentication of requests. Data available using this service may be subject to unauthorized access or interception. |
| STIG | Date |
|---|---|
| VMware ESX 3 Server | 2016-05-13 |
Details
| Check Text ( C-716r2_chk ) |
|---|
| Determine if the TFTP daemon is active. If it is, this is a finding unless documented using site-defined procedures. |
| Fix Text (F-4623r2_fix) |
|---|
| Disable the TFTP daemon. |