Global initialization files must contain the mesg -n or mesg n commands.

From Oracle Linux 5 Security Technical Implementation Guide

Associated with: CCI-000366

SV-63875r1_rule Global initialization files must contain the mesg -n or mesg n commands.

Vulnerability discussion

If the "mesg -n" or "mesg n" command is not placed into the system profile, messaging can be used to cause a Denial of Service attack.

Check content

Check global initialization files for the presence of "mesg -n" or "mesg n". Procedure: # grep "mesg" etc/bashrc /etc/csh.cshrc /etc/csh.login /etc/csh.logout /etc/environment /etc/ksh.kshrc /etc/profile /etc/suid_profile /etc/profile.d/* If no global initialization files contain "mesg -n" or "mesg n", this is a finding.

Fix text

Edit /etc/profile or another global initialization script, and add the "mesg -n" command.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.