STIGQter STIGQter: STIG Summary: Oracle HTTP Server 12.1.3 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 24 Jul 2020:

All accounts installed with the web server software and tools must have passwords assigned and default passwords changed.

DISA Rule

SV-79143r2_rule

Vulnerability Number

V-64653

Group Title

SRG-APP-000516-WSR-000174

Rule Version

OH12-1X-000207

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Inform the OHS Administrator as to what the password is for the OS account that owns the OHS Software.

Check Contents

NOTE: Service accounts or system accounts that have no login capability do not need to have passwords set or changed.

Review the web server documentation and deployment configuration to determine what non-service/system accounts were installed by the web server installation process.

Verify the passwords for these accounts have been set and/or changed from the default passwords.

Verify the SA/Web manager are notified of the changed password.

If these accounts still have no password or have default passwords, this is a finding.

If the SA/web manager does not know the changed password, this is a finding.

Vulnerability Number

V-64653

Documentable

False

Rule Version

OH12-1X-000207

Severity Override Guidance

NOTE: Service accounts or system accounts that have no login capability do not need to have passwords set or changed.

Review the web server documentation and deployment configuration to determine what non-service/system accounts were installed by the web server installation process.

Verify the passwords for these accounts have been set and/or changed from the default passwords.

Verify the SA/Web manager are notified of the changed password.

If these accounts still have no password or have default passwords, this is a finding.

If the SA/web manager does not know the changed password, this is a finding.

Check Content Reference

M

Target Key

2753

Comments