OHS must have Entity tags (ETags) disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221417	OH12-1X-000178	SV-221417r879887_rule		Medium

Description
Entity tags (ETags) are used for cache management to save network bandwidth by not sending a web page to the requesting client if the cached version on the client is current. When the client only has the ETag information, the client will make a request to the server with the ETag. The server will then determine if the client can use the client cached version of the web page or if a new version is required. As part of the ETag information, the server sends to the client the index node (inode) information for the file being requested. The inode information gives an attacker sensitive information like inode number, multipart MIME boundaries and makes certain NFS attacks much simpler to execute.

Description

Entity tags (ETags) are used for cache management to save network bandwidth by not sending a web page to the requesting client if the cached version on the client is current. When the client only has the ETag information, the client will make a request to the server with the ETag. The server will then determine if the client can use the client cached version of the web page or if a new version is required. As part of the ETag information, the server sends to the client the index node (inode) information for the file being requested. The inode information gives an attacker sensitive information like inode number, multipart MIME boundaries and makes certain NFS attacks much simpler to execute.

STIG	Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide	2022-12-09

Details

Check Text ( C-23132r414934_chk )
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor. 2. Search for the "Header" and "FileETag" directives at the OHS server, virtual host, or directory configuration scope. 3. If the "Header" and "FileETag" directives are omitted or set improperly, this is a finding.

Fix Text (F-23121r414935_fix)
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor. 2. Search for the "Header" and "FileETag" directives at the OHS server, virtual host, or directory configuration scopes. 3a. Set the "Header" directive to "unset ETag", add the directive if it does not exist. 3b. Set the "FileETag" directive to "none", add the directive if it does not exist.

Fix Text (F-23121r414935_fix)

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "Header" and "FileETag" directives at the OHS server, virtual host, or directory configuration scopes.

3a. Set the "Header" directive to "unset ETag", add the directive if it does not exist.
3b. Set the "FileETag" directive to "none", add the directive if it does not exist.