The Solidcore client Command Line Interface (CLI) must be in lockdown mode.

From McAfee Application Control 7.x Security Technical Implementation Guide

Associated with: CCI-001762

SV-88885r1_rule The Solidcore client Command Line Interface (CLI) must be in lockdown mode.

Vulnerability discussion

By default, when an endpoint's Solidcore installation is managed by the ePO server, the CLI will automatically be in lockdown mode. This will ensure the endpoint receives all of its Solidcore configuration settings from the ePO server. The CLI can, however, be activated for troubleshooting efforts during which time the ePO settings will not be enforced. Leaving the CLI in an allowed status will prevent the endpoint from receiving changes from the ePO server for the Solidcore client.

Check content

Determine CLI status. Access the system being reviewed. From an operating system command line, execute the following command: sadmin status If the status for CLI is "Allowed", this is a finding.

Fix text

From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Click "Actions". Select "New Client Task Assignment" to open the Client Task Assignment Builder page. Select the "Solidcore 7.0.0 product", "SC: Change Local CLI Access" task type, then click "Create New Task" to open the Client Task Catalog page. Change "CLI status" to "Restrict". Click "Save".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.