Title

The Tomcat server must protect log information from unauthorized modification. (Cat II impact)

Discussion

If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage. Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access. Log information includes all information (e.g., log records, log settings, transaction logs and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized modification.

Check Content

Check the permissions on all log files in CATALINE_HOME/logs: The permissions should be 640 or less permissive. If they are more permissive, this is a finding.

Fix Text

Configure the application server to protect log information from unauthorized modification.

Additional Identifiers

Rule ID: SV-47059r3_rule

Vulnerability ID: V-35772

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.