← Back to Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

V-221430

CAT II (Medium)

OHS must limit access to the Dynamic Monitoring Service (DMS).

Rule ID

SV-221430r961863_rule

STIG

Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

Version

V2R3

CCIs

CCI-000366

Discussion

The Oracle Dynamic Monitoring Service (DMS) enables application developers, support analysts, system administrators, and others to measure application specific performance information. If OHS allows any machine to connect and monitor performance, an attacker could connect and gather information that could be used to cause a DoS for OHS. Information that is shared could also be used to further an attack to other servers and devices through trusted relationships.

Check Content

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/admin.conf in it with an editor.

2. Search for the "Allow" directive within the "<Location /dms/>" directive at the virtual host configuration scope.

3. If the "Allow" directive is set to "from all", this is a finding.

Fix Text

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/admin.conf with an editor.

2. Search for the "Allow" directive within the "<Location /dms/>" virtual host configuration scope.

3. Set the "Allow" directive to "from 127.0.0.1".