STIGQter STIGQter: STIG Summary: Adobe ColdFusion 11 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 26 Jan 2018:

ColdFusion must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.

DISA Rule

SV-76969r2_rule

Vulnerability Number

V-62479

Group Title

SRG-APP-000427-AS-000264

Rule Version

CF11-05-000178

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. Remove the certificates that have a CA that is non-DoD approved and import DoD CA-approved certificates.

Check Contents

Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. To view the certificates stored within this file, execute the java command keytool -list -v -keystore ./cacerts and verify that the Certificate Authority (CA) for each certificate is DoD-approved.

If any certificates have a CA that is not DoD-approved, this is a finding.

Vulnerability Number

V-62479

Documentable

False

Rule Version

CF11-05-000178

Severity Override Guidance

Locate the cacerts file for the JVM. This can be done using the appropriate find command for the OS and change to the directory where the cacerts file is located. To view the certificates stored within this file, execute the java command keytool -list -v -keystore ./cacerts and verify that the Certificate Authority (CA) for each certificate is DoD-approved.

If any certificates have a CA that is not DoD-approved, this is a finding.

Check Content Reference

M

Target Key

2661

Comments