Check: GEN002340
Solaris 9 X86 STIG:
GEN002340
(in version v1 r9)
Title
Audio devices must be owned by root. (Cat II impact)
Discussion
Globally Accessible audio and video devices have proven to be security hazards. There is software that can activate system microphones and video devices connected to user workstations and/or X terminals. Once the microphone has been activated, it is possible to eavesdrop on otherwise private conversations without the victim being aware of it. This action effectively changes the user's microphone to a bugging device.
Check Content
Check the owner of audio devices. # ls -lL /dev/audio If the owner of any audio device file is not root, this is a finding.
Fix Text
Change the owner of the audio device. # chown root <audio device>
Additional Identifiers
Rule ID: SV-27246r1_rule
Vulnerability ID: V-1049
Group Title:
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
| Number | Title |
|---|---|
| AC-6 |
Least Privilege |