STIGQter STIGQter: STIG Summary: Oracle HTTP Server 12.1.3 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 24 Jul 2020:

OHS must provide the capability to immediately disconnect or disable remote access to the hosted applications.

DISA Rule

SV-78991r1_rule

Vulnerability Number

V-64501

Group Title

SRG-APP-000316-WSR-000170

Rule Version

OH12-1X-000034

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "<Directory>", "<Files>", or "<Location>" directive serving the application/content under attack at the OHS server, virtual host, or directory configuration scope.

3. Set the "Order" directive to "allow,deny", add the directive if it does not exist.

4. Comment out any "Allow" directives to prohibit access to the application/content under attack if it exists.

5. Set "Deny" directives to "from all" to prohibit access to the application/content under attack, add the directive if it does not exist.

6. Issue a "nmSoftRestart(serverName='componentName',serverType='OHS') from the WLST shell prompt.

Check Contents

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "<Directory>", "<Files>", or "<Location>" directive serving the application/content under attack at the OHS server, virtual host, or directory configuration scope.

3. If the "<Directory>", "<Files>", or "<Location>" directive serving the application/content under attack does not contain the appropriate "Order", "Deny", and "Allow" directives to prohibit access, this is a finding.

Vulnerability Number

V-64501

Documentable

False

Rule Version

OH12-1X-000034

Severity Override Guidance

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "<Directory>", "<Files>", or "<Location>" directive serving the application/content under attack at the OHS server, virtual host, or directory configuration scope.

3. If the "<Directory>", "<Files>", or "<Location>" directive serving the application/content under attack does not contain the appropriate "Order", "Deny", and "Allow" directives to prohibit access, this is a finding.

Check Content Reference

M

Target Key

2753

Comments