Check: PHTN-67-000070
VMware vSphere 6.7 Photon OS STIG:
PHTN-67-000070
(in versions v1 r6 through v1 r1)
Title
The Photon operating system must remove all software components after updated versions have been installed. (Cat II impact)
Discussion
Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.
Check Content
At the command line, execute the following command: # grep -i "^clean_requirements_on_remove" /etc/tdnf/tdnf.conf Expected result: clean_requirements_on_remove=true If the output does not match the expected result, this is a finding.
Fix Text
Open /etc/tdnf/tdnf.conf with a text editor. Remove any existing "clean_requirements_on_remove" line and ensure the following line is present: clean_requirements_on_remove=true
Additional Identifiers
Rule ID: SV-239141r856059_rule
Vulnerability ID: V-239141
Group Title: SRG-OS-000437-GPOS-00194
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002617 |
The organization removes organization-defined software components (e.g., previous versions) after updated versions have been installed. |
Controls
Number | Title |
---|---|
SI-2 (6) |
Removal Of Previous Versions Of Software / Firmware |