STIGQter: STIG Summary: Oracle HTTP Server 12.1.3 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 24 Jul 2020:

OHS must use wallets that have only DoD certificate authorities defined.

DISA Rule

SV-79017r1_rule

Vulnerability Number

V-64527

Group Title

SRG-APP-000427-WSR-000186

Rule Version

OH12-1X-000303

Severity

CAT II

CCI(s)

• CCI-002470 - The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

1. Go to the location of the OHS keystores (e.g., cd $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/keystores).

2. For each wallet directory located there, do the following:

a) Issue the command "$ORACLE_HOME/oracle_common/bin/orapki wallet display -wallet <wallet_directory>".
b) Remove each Trusted Certificate from the wallet that is not an appropriate DoD Certificate Authority with the command "$ORACLE_HOME/oracle_common/bin/orapki wallet remove -wallet <wallet_directory> -dn <dn_of_the_trusted_certificate> -trusted_cert".

Check Contents

1. Go to the location of the OHS keystores (e.g., cd $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/keystores).

2. For each wallet directory located there, do the following:

a) Issue the command "$ORACLE_HOME/oracle_common/bin/orapki wallet display -wallet <wallet_directory>".
b) Confirm that only the appropriate DoD Certificate Authorities are listed as Trusted Certificates.

3. If any of the Trusted Certificates are not appropriate DoD Certificate Authorities, this is a finding.

Vulnerability Number

V-64527

Documentable

False

Rule Version

OH12-1X-000303

Severity Override Guidance

1. Go to the location of the OHS keystores (e.g., cd $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/keystores).

2. For each wallet directory located there, do the following:

a) Issue the command "$ORACLE_HOME/oracle_common/bin/orapki wallet display -wallet <wallet_directory>".
b) Confirm that only the appropriate DoD Certificate Authorities are listed as Trusted Certificates.

3. If any of the Trusted Certificates are not appropriate DoD Certificate Authorities, this is a finding.

Check Content Reference

M

Target Key

2753

Comments