STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

The IBM z/OS TFTP Server program must be properly protected.

DISA Rule

SV-223524r533198_rule

Vulnerability Number

V-223524

Group Title

SRG-OS-000368-GPOS-00154

Rule Version

ACF2-FT-000080

Severity

CAT II

CCI(s)

• CCI-001764 - The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Configure the resource controls for the TFTP Server programs TFTPD and EZATD and ensure all access is restricted.

Evaluate the impact of implementing the following change. Develop a plan of action and implement the change as required.

Configure the resource controls for the TFTP Server programs TFTPD and EZATD and ensure all access is restricted.

Examples:
SET CONTROL(GSO)
CHANGE PPGM PGM-MASK(TFTPD EZATD) ADD

F ACF2,REFRESH(PPGM)

$KEY(TFTPD) TYPE(PGM)
UID(*) PREVENT

SET R(PGM)
COMPILE 'ACF2.MVA.PGM(TFTPD)' STORE

F ACF2,REBUILD(PGM)

$KEY(EZATD) TYPE(PGM)
UID(*) PREVENT

SET R(PGM)
COMPILE 'ACF2.MVA.PGM(EZATD)' STORE

F ACF2,REBUILD(PGM)

Check Contents

From the ACF Command screen enter:
SET CONTROL(GSO)
LIST LIKE(PPGM-)

If Programs TFTPD and EZATD are not defined in the GSO PPGM record, this is a finding.

From the ACF Command screen enter:
SET RESOURCE(PGM)
LIST LIKE(-)

If Program resources TFTPD and EZATD are not defined in the PROGRAM resource class, this is a finding.

If No access to the program resources TFTPD and EZATD is permitted, this is not a finding.

Vulnerability Number

V-223524

Documentable

False

Rule Version

ACF2-FT-000080

Severity Override Guidance

From the ACF Command screen enter:
SET CONTROL(GSO)
LIST LIKE(PPGM-)

If Programs TFTPD and EZATD are not defined in the GSO PPGM record, this is a finding.

From the ACF Command screen enter:
SET RESOURCE(PGM)
LIST LIKE(-)

If Program resources TFTPD and EZATD are not defined in the PROGRAM resource class, this is a finding.

If No access to the program resources TFTPD and EZATD is permitted, this is not a finding.

Check Content Reference

M

Target Key

4100

Comments