Oracle JRE 8 deployment.config file must contain proper keys and values.

From Java Runtime Environment (JRE) version 8 STIG for Unix

Part of SRG-APP-000516

Associated with: CCI-000366

SV-81399r2_rule Oracle JRE 8 deployment.config file must contain proper keys and values.

Vulnerability discussion

The deployment.config configuration file contains two keys. The "deployment.properties" key includes the path of the "deployment.properties" file and the "deployment.properties.mandatory" key contains either a TRUE or FALSE value. If the path specified to "deployment.properties" does not lead to a "deployment.properties" file, the value of the “deployment.system.config.mandatory” key determines how JRE will handle the situation. If the value of the "deployment.system.config.mandatory" key is TRUE and if the path to the "deployment.properties" file is invalid, the JRE will not allow Java applications to run. This is the desired behavior.

Check content

Navigate to the “deployment.config” file for JRE: /etc/.java/deployment/deployment.config The deployment.config file contains two properties: deployment.system.config and deployment.system.config.mandatory. The "deployment.system.config" key points to the location of the deployment.properties file. The location is variable. It can point to a file on the local disk, or a UNC path. The following is an example: “deployment.system.config=/etc/.java/deployment/deployment.properties" If the “deployment.system.config” key does not exist or does not point to the location of the deployment.properties file, this is a finding. If the “deployment.system.config.mandatory” key does not exist or is set to false, this is a finding.

Fix text

Navigate to the “deployment.config” file for JRE: /etc/.java/deployment/deployment.config Add the key “deployment.system.config=” to the deployment.config file. The following is an example: “deployment.system.config=/etc/.java/deployment/deployment.properties". Note the use of forward slashes. Add the key “deployment.system.config.mandatory=true” to the deployment.config file.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer