tc Server ALL must have all mappings to unused and vulnerable scripts to be removed.

From VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide

Associated with: CCI-000381

SV-99565r1_rule tc Server ALL must have all mappings to unused and vulnerable scripts to be removed.

Vulnerability discussion

Scripts allow server side processing on behalf of the hosted application user or as processes needed in the implementation of hosted applications. Removing scripts not needed for application operation or deemed vulnerable helps to secure the web server.To assure scripts are not added to the web server and run maliciously, those script mappings that are not needed or used by the web server for hosted application operation must be removed. Because tc Server is installed as part of the entire vROps application, and not installed separately, VMware has ensured that scripts not needed for application operation or deemed vulnerable have been removed from tc Server.

Check content

Obtain supporting documentation from the ISSO. Review the web server documentation and deployed configuration to determine if all mappings to unused and vulnerable scripts to be removed. If all mappings to unused and vulnerable scripts have not been removed, this is a finding.

Fix text

Document the removal of all script mappings that are not needed for web server and hosted application operation and ensure the web server configuration does not contain any script mappings that are not needed for web server and hosted application operation.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.