The Cassandra Server must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

From vRealize - Cassandra Security Technical Implementation Guide

Part of SRG-APP-000267-DB-000163

Associated with: CCI-001314

SV-87303r1_rule The Cassandra Server must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

Vulnerability discussion

If the DBMS provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk" would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. Administrative users authorized to review detailed error messages typically are the ISSO, ISSM, SA and DBA. Other individuals or roles may be specified according to organization-specific needs, with DBA approval.

Check content

Review the Cassandra Server to ensure detailed error messages are only revealed to the ISSO, ISSM, SA and DBA. At the command prompt, execute the following command: # ls -l /usr/lib/vmware-vcops/user/conf/cassandra If any file is not owned by "admin", this is a finding.

Fix text

Configure the Cassandra Server to only reveal detailed error messages to the ISSO, ISSM, SA and DBA. At the command prompt, execute the following command: # chown admin /usr/lib/vmware-vcops/user/conf/cassandra/ Replace with any file not owned by "admin".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer