ColdFusion must send log records to the operating system logging facility.

From Adobe ColdFusion 11 Security Technical Implementation Guide

Associated with: CCI-001348

SV-76875r1_rule ColdFusion must send log records to the operating system logging facility.

Vulnerability discussion

Protection of log data includes assuring log data is not accidentally lost or deleted. By sending some of the log messages to the operating system logging facilities, these log messages become part of the OS log history, become part of the log review performed by the OS administrator, and become part of the backup of OS log data.Note: This feature is only available for Linux installations.

Check content

This feature is not present when ColdFusion is installed on Windows; therefore, this finding is not applicable. Within the Administrator Console, navigate to the "Logging Settings" page under the "Debugging & Logging" menu. If "Use operating system logging facilities" is not checked, this is a finding.

Fix text

Navigate to the "Logging Settings" page under the "Debugging & Logging" menu. Check "Use operating system logging facilities" and select the "Submit Changes" button.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.