Title

The system must have IEEE 1394 (Firewire) disabled unless needed. (Cat III impact)

Discussion

Firewire is a common computer peripheral interface. Firewire devices may include storage devices that could be used to install malicious software on a system or exfiltrate data.

Check Content

If the system needs IEEE 1394 (Firewire), this is not applicable. Check if the firewire module is not disabled. # grep 'exclude: s1394' /etc/system If no results are returned, this is a finding.

Fix Text

Disable the firewire module. # echo "exclude: s1394" >> /etc/system Reboot for the changes to take effect.

Additional Identifiers

Rule ID: SV-227979r603266_rule

Vulnerability ID: V-227979

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.