Title

ISO images are not restricted to authorized users. (Cat II impact)

Discussion

Virtual machines are created from using operating system CD-ROMs or ISO images of the operating system. ISO operating system images reduce the time in deploying virtual machine servers since the media is readily available as a file on the hard drive. Also, ISO operating system images map easily to the virtual machine CD-ROM drive of the guest machine once the guest machine is running. Unauthorized access to the ISO operating system images could potentially allow these images to be corrupted or altered in some way.

Check Content

On the ESX Server service console perform the following command to determine if the /ISO, /Utilities, or /vmimages file partitions are accessible to unauthorized users. # ls -la /vmimages (Or the name of the partition) Permissions for .iso files should be 440 (r--r-----). If they are not 440 or more restrictive, this is a finding.

Fix Text

Restrict iso images to only authorized users.

Additional Identifiers

Rule ID: SV-16825r1_rule

Vulnerability ID: V-15884

Group Title: ISO images are not restricted to authorized users

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.