Detections
Analytics
SRG-OS-99999-ESXI5-000151 - The system must prevent unintended use of dvfilter network APIs
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
If products that use the dvfilter network API are not used, the host should not be configured to send network information to a VM. If the API is enabled, an attacker might attempt to connect a VM to it, thereby potentially providing access to the network of other VMs on the host. If a product uses this API, the host must be verified as being correctly configured.Solution
From the vSphere client select the host and click 'Configuration >> Advanced Settings >> Net' Set the value of Net.DVFilterBindIpAddress to blank if a dvfilter-based network security appliance is not used or (where used) set the value of Net.DVFilterBindIpAddress to match the dvfilter-based network security appliance.See Also
http://iasecontent.disa.mil/stigs/zip/U_ESXi5_Server_V1R10_STIG.zip
Item Details
Audit Name: DISA STIG VMWare ESXi Server 5 STIG v1r10
Category: ACCESS CONTROL
References: 800-53|AC-3, CAT|III, CCI|CCI-000366, Group-ID|V-39346, Rule-ID|SV-51204r1_rule, STIG-ID|SRG-OS-99999-ESXI5-000151, Vuln-ID|V-39346
Plugin: VMware
Control ID: 7eb775655681a65d226ffd205e08a58d643cf48a44fc2fb07da921d1b6925754