Java Runtime Environment (JRE) version 7 STIG for WinXP

U_JRE7WinXP_V1R5_Manual-xccdf.xml

Version/Release Published Filters Downloads Update
V1R5 2014-10-05      
Update existing CKLs to this version of the STIG
The Java Runtime Environment (JRE) is a bundle developed and offered by Oracle Corporation which includes the Java Virtual Machine (JVM), class libraries, and other components necessary to run Java applications and applets. Certain default settings within the JRE pose a security risk so it is necessary to deploy system wide properties to ensure a higher degree of security when utilizing the JRE.
Vuln Rule Version CCI Severity Title Description
SV-43208r2_rule JRE0001-J7XP MEDIUM The dialog enabling users to grant permissions to execute signed content from an un-trusted authority must be disabled. Java applets exist in both signed and unsigned forms. Although signed applets allow for authentication of the author in order to establish trust, even signed applets can potentially contain malware. Applet sources considered trusted will normally have their certificate information populated into the browser. This enables Java to validate applets against trusted sources automatically. Permitting users to grant execution permissions to Java applets signed by un-trusted authorities may result in malware executing on the system. This risks system confidentiality, integrity and availability. DCBP-1
SV-43211r2_rule JRE0010-J7XP MEDIUM The dialog enabling users to grant permissions to execute signed content from an un-trusted authority must be locked. Java applets exist in both signed and unsigned forms. Although signed applets allow for authentication of the author in order to establish trust, even signed applets can potentially contain malware. Applet sources considered trusted will normally have their certificate information populated into the browser. This enables Java to validate applets against trusted sources automatically. Permitting users to grant execution permissions to Java applets signed by un-trusted authorities may result in malware executing on the system. This risks system confidentiality, integrity and availability. The setting must be locked so users cannot change the setting. Ensuring users cannot change settings contributes to a more consistent security profile. DCBP-1
SV-43214r2_rule JRE0020-J7XP MEDIUM The dialog to enable users to check publisher certificates for revocation must be enabled. A certificate revocation list is a directory which contains a list of certificates that have been revoked for various reasons. Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found on a CRL should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service. DCBP-1
SV-43217r3_rule JRE0030-J7XP MEDIUM The option to enable users to check publisher certificates for revocation must be locked. Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found revoked on a CRL or via Online Certificate Status Protocol (OCSP) should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service. Ensuring users cannot change these settings assures a more consistent security profile. DCBP-1
SV-43220r2_rule JRE0040-J7XP MEDIUM The option to enable online certificate validation must be enabled. Online certificate validation provides a real-time option to validate a certificate. When enabled, if a certificate is presented, the status of the certificate is requested. The status is sent back as 'current', 'expired', or 'unknown'. Online certificate validation provides a greater degree of validation of certificates when running a signed Java applet. Permitting execution of an applet with an invalid certificate may result in malware, system modification, invasion of privacy, and denial of service. DCBP-1
SV-43223r2_rule JRE0050-J7XP MEDIUM The option to enable online certificate validation must be locked. Online certificate validation provides a real-time option to validate a certificate. When enabled, if a certificate is presented, the status of the certificate is requested. The status is sent back as 'current', 'expired', or 'unknown'. Online certificate validation provides a greater degree of validation of certificates when running a signed Java applet. Permitting execution of an applet with an invalid certificate may result in malware, system modification, invasion of privacy, and denial of service. Ensuring users cannot change settings contributes to a more consistent security profile. DCBP-1
SV-43644r2_rule JRE0060-J7XP MEDIUM The configuration file must contain proper keys and values to deploy settings correctly. This configuration file must hold values of the location of the deployment.properties file, as well as the enforcement of these properties. Without a proper path for the properties file, deployment would not be possible. If the path specified does not lead to a properties file the value of the 'deployment.system.config. mandatory' key determines how to handle the situation. If the value of this key is true, JRE will not run if the path to the properties file is invalid. DCBP-1
SV-43296r2_rule JRE0070-J7XP MEDIUM A configuration file must be present to deploy properties for JRE. The deployment.config file is used for specifying the location and execution of system-level properties for the Java Runtime Environment. By default no deployment.config file exists; thus, no system-wide deployment.properties file exists. 64-bit systems require two copies of the file, one for the 64-bit JRE and the other for the 32-bit JRE. Without the deployment.config file, setting particular options for the Java control panel is impossible.DCBP-1
SV-43299r2_rule JRE0080-J7XP MEDIUM A properties file must be present to hold all the keys that establish properties within the Java control panel. The deployment.properties file is used for specifying keys for the Java Runtime Environment. Each option in the Java control panel is represented by property keys. These keys adjust the options in the Java control panel based on the value assigned to that key. By default no deployment.properties file exists; thus, no system-wide deployment exists. Without the deployment.properties file, setting particular options for the Java control panel is impossible. DCBP-1
SV-51123r1_rule JRE0090-J7XP MEDIUM The version of the JRE running on the system must be the most current available. The JRE is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the JRE can introduce security vulnerabilities to the system.Java applications are runtime version dependant. Applications must be tested to ensure compatability with new Java Runtime version prior to applying upgrades to production environment. Failure to test application functionality with the newest version of JRE could result in undesireable results up to and including partial or full application failure.System AdministratorDCBP-1
SV-68629r1_rule JRE9999-UNSPTD-OS HIGH The Java Runtime Environment (JRE) must not be installed on an unsupported operating system. Security updates are the standard method for addressing discovered vulnerabilities. The operating system platform the JRE is installed on must be supported for security updates or the OS becomes a threat vector that can negatively impact the JRE. Organizations must run the JRE on a supported OS version to ensure security updates are available and to mitigate threats to the JRE.System AdministratorDCSQ-1