Bonjour must be disabled.

From MAC OSX 10.6 Workstation Security Technical Implementation Guide

Associated with IA controls: ECSC-1

SV-38581r1_rule Bonjour must be disabled.

Vulnerability discussion

Bonjour is unnecessary in a managed environment and presents an attack surface. Its behavior, which trusts the local network, is especially inappropriate on portable devices which may connect to untrusted networks.

Check content

Open a terminal session and enter the following command. sudo ipfw print. If no line contains "deny udp from any to me dst-port 5353" or a more restrictive rule, this is a finding.

Fix text

Open a terminal session and edit or create /Library/LaunchDaemons/org.freebsd.ipfw.plist and ensure it contains the following: Label org.freebsd.ipfw Program /sbin/ipfw ProgramArguments /sbin/ipfw /etc/ipfw.conf RunAtLoad Edit or create /etc/ipfw.conf and ensure it contains the following line (the first number, a line number, may need to be changed if another line already begins with that number): Add 10 deny udp from any to me dst-port 5353

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.