2.3 Alter the Advertised server.built Date

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The server.built date represents the date which Tomcat was compiled and packaged. This value is presented to Tomcat clients when clients connect to the server.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Perform the following to alter the server built date that gets displayed when clients connect to the tomcat server.
1. Extract the ServerInfo.properties file from the catalina.jar file:
$ cd $CATALINA_HOME/lib
$ jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties
2. Navigate to the util directory that was created
cd org/apache/catalina/util
3. Open ServerInfo.properties in an editor
4. Update the server.info attribute in the ServerInfo.properties file.
server.built=
5. Update the catalina.jar with the modified ServerInfo.properties file.
$ jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties

See Also

https://workbench.cisecurity.org/files/267

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-30

Plugin: Unix

Control ID: f02709802a40546614c1ea7e63bbfea5c6128ef86901e0958fc1a8e261576303