STIGQter: STIG Summary: zOS WebSphere Application Server for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

The CBIND Resource(s) for the WebSphere Application Server is(are) not protected in accordance with security requirements.

DISA Rule

SV-224351r1141675_rule

Vulnerability Number

V-224351

Group Title

SRG-OS-000080

Rule Version

ZWAS0030

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

The ISSO will ensure that the CBIND resource is defined to the ACP with an access of none.

Ensure the following items are in effect for CBIND resource protection:

The CLASMAP record defines the CBIND resource class.

The CBIND class defaults to a generic type code of SAF. It is recommended that a GSO CLASMAP record be added to change this to a site-selected resource unique to the CBIND class such as CBI. The following shows how the suggested change example would be coded:

SET CONTROL(GSO)
INSERT CLASMAP.cbind RESOURCE(CBIND) RSRCTYPE(cbi) -ENTITYLN(41)

The CB.BIND.server_name resource is defined to the CBIND resource class with a default access of PREVENT.

Access to the CB.BIND.server_name resource is restricted to WAS server (STC) logonids and systems management logonids (e.g., WebSphere administrator ID).

Example:

$KEY(CB) TYPE(CBI)
BBOASR1 UID(was_admin_uid) SERVICE(READ) ALLOW
BIND.BBOASR1 UID(was_admin_uid) SERVICE(READ) ALLOW
UID(*) PREVENT

Check Contents

Refer to the following reports produced by the dataset and Resource Data Collection:

- ACF2CMDS.RPT(ACFGSO).
- SENSITVE.RPT(CBIND).

If the following items are in effect for CBIND resource protection, this is not a finding.

The CLASMAP record defines the CBIND resource class.

The CB.BIND.server_name resource is defined to the CBIND resource class with a default access of PREVENT.

Access to the CB.BIND.server_name resource is restricted to WAS server (STC) logonids and systems management logonids (e.g., WebSphere administrator ID).

Vulnerability Number

V-224351

Documentable

False

Rule Version

ZWAS0030

Severity Override Guidance

Refer to the following reports produced by the dataset and Resource Data Collection:

- ACF2CMDS.RPT(ACFGSO).
- SENSITVE.RPT(CBIND).

If the following items are in effect for CBIND resource protection, this is not a finding.

The CLASMAP record defines the CBIND resource class.

The CB.BIND.server_name resource is defined to the CBIND resource class with a default access of PREVENT.

Access to the CB.BIND.server_name resource is restricted to WAS server (STC) logonids and systems management logonids (e.g., WebSphere administrator ID).

Check Content Reference

M

Target Key

4132