STIGQter: STIG Summary: Oracle Linux 7 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Oracle Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.

DISA Rule

SV-221653r603260_rule

Vulnerability Number

V-221653

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

OL07-00-010020

Severity

CAT I

CCI(s)

• CCI-001749 - The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

Run the following command to determine which package owns the file:

# rpm -qf <filename>

The package can be reinstalled from a yum repository using the command:

# sudo yum reinstall <packagename>

Alternatively, the package can be reinstalled from trusted media using the command:

# sudo rpm -Uvh <packagename>

Check Contents

Verify the cryptographic hash of system files and commands match the vendor values.

Check the cryptographic hash of system files and commands with the following command:

Note: System configuration files (indicated by a "c" in the second column) are expected to change over time. Unusual modifications should be investigated through the system audit log.

# rpm -Va --noconfig | grep '^..5'

If there is any output from the command for system files or binaries, this is a finding.

Vulnerability Number

V-221653

Documentable

False

Rule Version

OL07-00-010020

Severity Override Guidance

Verify the cryptographic hash of system files and commands match the vendor values.

Check the cryptographic hash of system files and commands with the following command:

Note: System configuration files (indicated by a "c" in the second column) are expected to change over time. Unusual modifications should be investigated through the system audit log.

# rpm -Va --noconfig | grep '^..5'

If there is any output from the command for system files or binaries, this is a finding.

Check Content Reference

M

Target Key

4089

Comments