Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-239662 | VCST-67-000011 | SV-239662r816711_rule | Medium |
Description |
---|
The "package.access" entry in the "catalina.properties" file implements access control at the package level. When properly configured, a Security Exception will be reported if an errant or malicious web app attempts to access the listed internal classes directly or if a new class is defined under the protected packages. The Security Token Service comes preconfigured with the appropriate packages defined in "package.access", and this configuration must be maintained. |
STIG | Date |
---|---|
VMware vSphere 6.7 STS Tomcat Security Technical Implementation Guide | 2022-01-03 |
Check Text ( C-42895r816709_chk ) |
---|
Connect to the PSC, whether external or embedded. At the command prompt, execute the following command: # grep "package.access" /usr/lib/vmware-sso/vmware-sts/conf/catalina.properties Expected result: package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper. If the output of the command does not match the expected result, this is a finding. |
Fix Text (F-42854r816710_fix) |
---|
Connect to the PSC, whether external or embedded. Navigate to and open /usr/lib/vmware-sso/vmware-sts/conf/catalina.properties. Ensure that the "package.access" line is configured as follows: package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper. |