The Sun Ray server console administration sessions are not encrypted.

Part of Sun Ray server console admin session not encrypted

Associated with IA controls: ECCT-1, ECCT-2

SV-17134r1_rule The Sun Ray server console administration sessions are not encrypted.

Vulnerability discussion

Unencrypted Sun Ray server console sessions do not protect the information transmitted from being read or viewed by anyone. Unencrypted sessions are vulnerable to a number of attacks to include man-in-the-middle attacks, TCP Hijacking, and replay.

Check content

Have the administrator log into the Sun Ray administrator console by typing the following: http://localhost:1660. If the session does not switch to https://localhost:1661 in the browser, this is a finding.

Fix text

Encrypt all Sun Ray server console sessions.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.