The vCenter Lookup service must disable stack tracing.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259043 | VCLU-80-000036 | SV-259043r934787_rule | CCI-000381 | medium |
| Description | ||||
| Stack tracing provides debugging information from the application call stacks when a runtime error is encountered. If stack tracing is left enabled, Tomcat will provide this call stack information to the requestor, which could result in the loss of sensitive information or data that could be used to compromise the system. | ||||
| STIG | Date | |||
| VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide | 2023-10-29 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.6
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000381
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-259043r934787_chk)
At the command prompt, run the following command:
# xmllint --xpath "//Connector[@allowTrace = 'true']" /usr/lib/vmware-lookupsvc/conf/server.xml
Expected result:
XPath set is empty
If any connectors are returned, this is a finding.
Fix Text (F-62692r934786_fix)
Navigate to and open:
/usr/lib/vmware-lookupsvc/conf/server.xml
Navigate to and locate:
'allowTrace="true"'
Remove the 'allowTrace="true"' setting.
Note: If "allowTrace" is not present, it defaults to "false".
Restart the service with the following command:
# vmon-cli --restart lookupsvc