STIGQter: STIG Summary: IBM AIX 7.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The local initialization file lists of preloaded libraries must contain only absolute paths on AIX.

DISA Rule

SV-215425r508663_rule

Vulnerability Number

V-215425

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

AIX7-00-003130

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Edit the local initialization file and remove the relative path entry from the library preload variable "LDR_PRELOAD".

Check Contents

Identify local initialization files that have library search paths:

# cat /etc/passwd | cut -f 1,1 -d ":" | xargs -n1 -IUSER sh -c 'grep -l LDR_PRELOAD ~USER/.*'
/root/.sh_history
/home/doejohn/.profile
/home/doejane/.profile

For each file identified above, verify the search path contains only absolute paths:
Note: This variable is formatted as a colon-separated list of paths.

# cat <local_initilization_file> | grep -Ei 'ldr|preload'
LDR_PRELOAD=/usr/lib

If the paths listed have not been documented and authorized by the ISSO/ISSM, this is a finding.
If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding.
If an entry begins with a character other than a slash (/) or other than "$PATH", it is a relative path, and this is a finding.

Vulnerability Number

V-215425

Documentable

False

Rule Version

AIX7-00-003130

Severity Override Guidance

Identify local initialization files that have library search paths:

# cat /etc/passwd | cut -f 1,1 -d ":" | xargs -n1 -IUSER sh -c 'grep -l LDR_PRELOAD ~USER/.*'
/root/.sh_history
/home/doejohn/.profile
/home/doejane/.profile

For each file identified above, verify the search path contains only absolute paths:
Note: This variable is formatted as a colon-separated list of paths.

# cat <local_initilization_file> | grep -Ei 'ldr|preload'
LDR_PRELOAD=/usr/lib

If the paths listed have not been documented and authorized by the ISSO/ISSM, this is a finding.
If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding.
If an entry begins with a character other than a slash (/) or other than "$PATH", it is a relative path, and this is a finding.

Check Content Reference

M

Target Key

4012

Comments