DTAVSEL-111 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to Move infected files to the quarantine directory if first action fails when programs and jokes are found.

Information

Potentially Unwanted Programs (PUPs) include Spyware, Adware, Remote Administration Tools, Dialers, Password Crackers, Jokes, and Key Loggers. While PUPs do not typically have any infection capability on their own, they rely on malware or other attach mechanisms to be installed onto target hosts, after which they will collect and transfer data from the host to an external host and/or will be used as attach mechanisms. Configuring the anti-virus software to attempt to clean the file first will allow for the possibility of a false positive. In most cases, however, the secondary action of delete will be used, mitigating the risk of the PUPs being installed and used maliciously.

Solution

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, review tasks under 'View', 'Scheduled Tasks'.
With the System Administrator's assistance, determine which task is intended as the regularly scheduled scan task.
Click on the task, and then click 'Modify'.
Under '2. What to Scan', click 'Next'.
Under '3. Choose Scan Settings', Anti-virus Actions', select 'Quarantine' from the second dropdown list 'Actions for Programs and Jokes' if first action fails, click 'Next', and then click 'Finish'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_McAfee_VSEL_1-9_2-0_Y20M04_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3c.1., CAT|II, CCI|CCI-001241, Rule-ID|SV-77619r1_rule, STIG-ID|DTAVSEL-111, Vuln-ID|V-63129

Plugin: Unix

Control ID: 220ec024c736dcf9309e113b1bf5e2a69e07d523db71175863f3f11b7e011a55