DTAVSEL-101 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to decompress archives when scanning.

Information

Malware is often packaged within an archive. In addition, archives might have other archives within. Not scanning archive files introduces the risk of infected files being introduced into the environment.

Solution

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, review tasks under 'View', 'Scheduled Tasks'.
With the System Administrator's assistance, determine which task is intended as the regularly scheduled scan task.
Click on the task, and then click 'Modify'.
Under '2. What to Scan', click 'Next'.
Under '3. Choose Scan Settings', 'Anti-virus Scanning Options', select the 'Decompress archives' check box, click 'Next', and then click 'Finish'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_McAfee_VSEL_1-9_2-0_Y20M04_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3c.1., CAT|II, CCI|CCI-001241, Rule-ID|SV-77601r1_rule, STIG-ID|DTAVSEL-101, Vuln-ID|V-63111

Plugin: Unix

Control ID: 587d451f68648883832e9d158db69d69d774dae1858d26fd9234fc2df4174835