VCENTER-000007 - The managed object browser must be disabled, at all times, when not required for the purpose of troubleshooting or maintenance of managed objects.

Information

The managed object browser provides a way to explore the object model used by the vCenter to manage the vSphere environment; it enables configurations to be changed as well. This interface is used primarily for debugging, and might potentially be used to perform malicious configuration changes or actions.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

If the datastore browser is enabled and required for object maintenance, no fix is immediately required.

Disable the managed object browser:
Determine the location of the vpxd.cfg file on the Windows host.
Edit the file and locate the <vpxd> ... </vpxd> element.
Ensure the following element is set. <enableDebugBrowse>false</enableDebugBrowse>

Restart the vCenter Service to ensure the configuration file change(s) are in effect.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_vCenter_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-39547, Rule-ID|SV-250729r799877_rule, STIG-ID|VCENTER-000007, STIG-Legacy|SV-51405, STIG-Legacy|V-39547, Vuln-ID|V-250729

Plugin: VMware

Control ID: e2bf6d1bb15a00801c013bb4189e95e79169390429dbf2ea4a84ebdb3a00dd30