OpenControls Logo

STIG Viewer

STIGViewer Support

VAMI server binaries and libraries must be verified for their integrity.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-256653VCLD-70-000009SV-256653r888481_ruleCCI-001082medium
Description
Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and nonrepudiation of the information. VMware delivers product updates and patches regularly. When VAMI is updated, the signed packages will also be updated. These packages can be used to verify that VAMI has not been inappropriately modified since it was installed. The file "lighttpd.conf" and "vami-lighttp.service" are intentionally modified on first boot and thus are excluded from the check. Satisfies: SRG-APP-000131-WSR-000051, SRG-APP-000211-WSR-000030, SRG-APP-000380-WSR-000072
STIGDate
VMware vSphere 7.0 VAMI Security Technical Implementation Guide2023-06-15

Related Frameworks

3 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.1Automated Access Enforcement / Auditing
1.00
SEA-03.2Application Partitioning
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (56) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+46 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.3
1.00
CCI3 mappings
CCI-001082
1.00
CCI-001749
1.00
CCI-001813
1.00

Details

Check Text (C-256653r888481_chk)

At the command prompt, run the following command: # rpm -qa|grep lighttpd|xargs rpm -V|grep -v -E "lighttpd.conf|vami-lighttp.service" If the command returns any output, this is a finding.

Fix Text (F-60271r888480_fix)

If the VAMI binaries have been modified from the default state when deployed as part of the vCenter Server Appliance (VCSA), the system must be wiped and redeployed or restored from backup. VMware does not recommend or support recovering from such a state by reinstalling RPMs or similar efforts.