[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-90004-3

Platform: cpe:/o:apple:mac_os_x:10.9Date: (C)2015-06-11   (M)2023-07-04



Audit Account Creation, Modification, and Deletion Account creations and account modfications, such as disablement and termination, can all be signs of an intrusion and should be audited. Once an attacker establishes access to a system, the attacker may attempt to create an account to reestablish access at a later time. The attacker may also attempt to modify accounts in an attempt to change an existing account's privileges or disable or delete accounts in a denial-of-service attack. Auditing of account creation, modification, disabling, and termination events mitigates this risk.


Parameter:

[exists/does_not_exist]


Technical Mechanism:

In order to view the currently configured flags for the audit daemon, run the following command: sudo grep ^flags /etc/security/audit_control Privileged access, including the creation, modification, and deletion of local user accounts, is logged via the 'ad' flag. If 'ad' is not listed in the result of the check, this is a finding.

CCSS Severity:CCSS Metrics:
CCSS Score : 5.9Attack Vector: LOCAL
Exploit Score: 2.5Attack Complexity: LOW
Impact Score: 3.4Privileges Required: NONE
Severity: MEDIUMUser Interaction: NONE
Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LScope: UNCHANGED
 Confidentiality: LOW
 Integrity: LOW
 Availability: LOW
  

References:
Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:24638


OVAL    1
oval:org.secpod.oval:def:24638
XCCDF    1
xccdf_org.secpod_benchmark_general_Mac_OS_X_10_9

© SecPod Technologies