cyberstrikeus 10.13 Do not run applications as privileged (Automated)
Description
Setting the privileged attribute for an application changes the class loader to the Server class loader instead of the Shared class loader.
Rationale
Running an application in privileged mode allows an application to load the manager libraries.
Audit Procedure
Ensure the privileged attribute in each context.xml file does not exist or is set to false.
# find . -name context.xml | xargs grep "privileged"
Remediation
Set the privileged attribute in all context.xml files to false unless it is required as for the manager application:
<Context ... privileged="false" />
Default Value
By default, privileged has a value of false.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator AccountsRestrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account. | ● | ● | ● |
| v7 | 4 Controlled Use of Administrative PrivilegesControlled Use of Administrative Privileges |
Profile
Level 1