Oracle JRE 8 must lock the option to enable users to check publisher certificates for revocation.

From Java Runtime Environment (JRE) version 8 STIG for Unix

Associated with: CCI-001991

SV-81421r1_rule Oracle JRE 8 must lock the option to enable users to check publisher certificates for revocation.

Vulnerability discussion

Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found revoked on a CRL or via Online Certificate Status Protocol (OCSP) should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service.Ensuring users cannot change these settings assures a more consistent security profile.

Check content

If the system is on the SIPRNet, this requirement is NA. Navigate to the system-level “deployment.properties” file for JRE. /etc/.java/deployment/deployment.properties If the key “deployment.security.revocation.check=ALL_CERTIFICATES” is not present, or is set to “PUBLISHER_ONLY”, or “NO_CHECK”, this is a finding. If the key “deployment.security.revocation.check.locked” is not present, this is a finding.

Fix text

If the system is on the SIPRNet, this requirement is NA. Navigate to the system-level “deployment.properties” file for JRE. /etc/.java/deployment/deployment.properties Add the key “deployment.security.revocation.check=ALL_CERTIFICATES” to the deployment.properties file. Add the key “deployment.security.revocation.check.locked” to the deployment.properties file.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.