{
  "name": "stig_vmware_esxi_version_5_virtual_machine",
  "date": "2017-07-11",
  "description": "The VMware ESXi Version 5 Virtual Machine Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.",
  "title": "VMware ESXi Version 5 Virtual Machine Security Technical Implementation Guide",
  "version": "1",
  "item_syntax": "^\\w-\\d+$",
  "section_separator": null,
  "items": [
    {
      "id": "V-39442",
      "title": "The system must control virtual machine access to host resources.",
      "description": "By default, all virtual machines on an ESXi host share the resources equally. By using the resource management capabilities of ESXi, such as shares and limits, you can control the server resources that a virtual machine consumes.  You can use this mechanism to prevent a denial of service that causes one virtual machine to consume so much of the host's resources that other virtual machines on the same host cannot perform their intended functions.",
      "severity": "high"
    },
    {
      "id": "V-39443",
      "title": "The system must disable tools auto install.\n",
      "description": "Tools auto install can initiate an automatic reboot, disabling this option will prevent tools from being installed automatically and prevent automatic machine reboots.",
      "severity": "low"
    },
    {
      "id": "V-39444",
      "title": "The system must explicitly disable copy operations.\n",
      "description": "Copy and paste operations are disabled by default; however, by explicitly disabling this feature it will enable audit controls to check that this setting is correct. Copy, paste, drag and drop, or GUI copy/paste operations between the guest OS and the remote console could provide the means for an attacker to compromise the VM.\n",
      "severity": "low"
    },
    {
      "id": "V-39445",
      "title": "The system must explicitly disable drag and drop operations.\n",
      "description": "Copy and paste operations are disabled by default; however, by explicitly disabling this feature it will enable audit controls to check that this setting is correct. Copy, paste, drag and drop, or GUI copy/paste operations between the guest OS and the remote console could provide the means for an attacker to compromise the VM.\n",
      "severity": "low"
    },
    {
      "id": "V-39446",
      "title": "The system must explicitly disable any GUI functionality for copy/paste operations.\n",
      "description": "Copy and paste operations are disabled by default; however, by explicitly disabling this feature it will enable audit controls to check that this setting is correct. Copy, paste, drag and drop, or GUI copy/paste operations between the guest OS and the remote console could provide the means for an attacker to compromise the VM.\n",
      "severity": "low"
    },
    {
      "id": "V-39447",
      "title": "The system must explicitly disable paste operations.\n",
      "description": "Copy and paste operations are disabled by default; however, by explicitly disabling this feature it will enable audit controls to check that this setting is correct. Copy, paste, drag and drop, or GUI copy/paste operations between the guest OS and the remote console could provide the means for an attacker to compromise the VM.\n",
      "severity": "low"
    },
    {
      "id": "V-39448",
      "title": "The system must disable virtual disk shrinking.\n",
      "description": "Shrinking a virtual disk reclaims unused space in it. If there is empty space in the disk, this process reduces the amount of space the virtual disk occupies on the host drive. Normal users and processes-that is, users and processes without root or administrator privileges-within virtual machines have the capability to invoke this procedure. However, if this is done repeatedly, the virtual disk can become unavailable while this shrinking is being performed, effectively causing a denial-of-service. In most datacenter environments, disk shrinking is not done, so this feature must be disabled. Repeated disk shrinking can make a virtual disk unavailable. The capability to shrink is available to non-administrative users operating within the VMs guest OS.",
      "severity": "high"
    },
    {
      "id": "V-39449",
      "title": "The system must disable virtual disk erasure.\n",
      "description": "Shrinking and wiping (erasing) a virtual disk reclaims unused space in it. If there is empty space in the disk, this process reduces the amount of space the virtual disk occupies on the host drive. Normal users and processes - that is, users and processes without root or administrator privileges - within virtual machines have the capability to invoke this procedure. However, if this is done repeatedly, the virtual disk can become unavailable while this shrinking is being performed, effectively causing a denial-of-service. In most datacenter environments, disk shrinking is not done, so this feature must be disabled. Repeated disk shrinking can make a virtual disk unavailable. The capability to wipe (erase) is available to non-administrative users operating within the VMs guest OS.",
      "severity": "high"
    },
    {
      "id": "V-39450",
      "title": "The system must disable HGFS file transfers.\n",
      "description": "Certain automated operations such as automated tools upgrades, use a component into the hypervisor called \"Host Guest File System\" and an attacker could potentially use this to transfer files inside the guest OS.",
      "severity": "medium"
    },
    {
      "id": "V-39451",
      "title": "The system must not use independent, non-persistent disks.\n",
      "description": "The security issue with non-persistent disk mode is that successful attackers, with a simple shutdown or reboot, might undo or remove any traces that they were ever on the machine. To safeguard against this risk, production virtual machines should be set to use persistent disk mode; additionally, ensure activity within the VM is logged remotely on a separate server, such as a syslog server or equivalent Windows-based event collector. Without a persistent record of activity on a VM, administrators might never know whether they have been attacked or hacked.\n",
      "severity": "high"
    },
    {
      "id": "V-39452",
      "title": "The system must disable VM-to-VM communication through VMCI.\n",
      "description": "If the interface is not restricted, a VM can detect and be detected by all other VMs with the same option enabled within the same host. This might be the intended behavior, but custom-built software can have unexpected vulnerabilities that might potentially lead to an exploit. Additionally, it is possible for a VM to detect how many other VMs are within the same ESX system by simply registering the VM. This information might also be used for a potentially malicious objective. By default, the setting is FALSE. The VM can be exposed to other VMs within the same system as long as there is at least one program connected to the VMCI socket interface.",
      "severity": "medium"
    },
    {
      "id": "V-39453",
      "title": "The system must disable VM logging, unless required.",
      "description": "Excessive VM logging may degrade system performance. The following settings can be used to limit the total size and number of log files. Normally a new log file is created only when a host is rebooted, so the file can grow to be quite large. Ensure new log files are created more frequently by limiting the maximum size of the log files. To restrict the total size of logging data, VMware recommends saving 10 log files, each one limited to 1,000KB. Datastores are likely to be formatted with a block size of 2MB or 4MB, so a size limit too far below this size would result in unnecessary storage utilization. Each time an entry is written to the log, the size of the log is checked; if it is over the limit, the next entry is written to a new log. If the maximum number of log files already exists, when a new one is created, the oldest log file is deleted. A denial-of-service attack that avoids these limits might be attempted by writing an enormous log entry. But each log entry is limited to 4KB, so no log files are ever more than 4KB larger than the configured limit. A second option is to disable logging for the virtual machine. Disabling logging for a virtual machine makes troubleshooting challenging and support difficult. Do not consider disabling logging unless the log file rotation approach proves insufficient. Uncontrolled logging can lead to denial-of-service due to the datastore becoming filled.",
      "severity": "medium"
    },
    {
      "id": "V-39454",
      "title": "The system must disable VM Monitor Control during normal operation.\n",
      "description": "When Virtual Machines are running on a hypervisor they are \"aware\" that they are running in a virtual environment and this information is available to tools inside the guest OS.  This can give attackers information about the platform that they are running on that they may not get from a normal physical server.  This option completely disables all hooks for a virtual machine and the guest OS will not be aware that it is running in a virtual environment at all. This feature may be enabled for short term diagnostics and troubleshooting, but must be disabled prior to resumption of normal operations.",
      "severity": "medium"
    },
    {
      "id": "V-39456",
      "title": "The unexposed feature keyword isolation.tools.ghi.autologon.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39457",
      "title": "The unexposed feature keyword isolation.bios.bbs.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39458",
      "title": "The unexposed feature keyword isolation.tools.getCreds.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39459",
      "title": "The unexposed feature keyword isolation.tools.ghi.launchmenu.change must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39461",
      "title": "The unexposed feature keyword isolation.tools.memSchedFakeSampleStats.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39462",
      "title": "The unexposed feature keyword isolation.tools.ghi.protocolhandler.info.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39463",
      "title": "The unexposed feature keyword isolation.ghi.host.shellAction.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39477",
      "title": "The unexposed feature keyword isolation.tools.dispTopoRequest.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39478",
      "title": "The unexposed feature keyword isolation.tools.trashFolderState.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39479",
      "title": "The unexposed feature keyword isolation.tools.ghi.trayicon.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39480",
      "title": "The unexposed feature keyword isolation.tools.unity.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39481",
      "title": "The unexposed feature keyword isolation.tools.unityInterlockOperation.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39482",
      "title": "The unexposed feature keyword isolation.tools.unity.push.update.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39483",
      "title": "The unexposed feature keyword isolation.tools.unity.taskbar.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39484",
      "title": "The unexposed feature keyword isolation.tools.unityActive.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39485",
      "title": "The unexposed feature keyword isolation.tools.unity.windowContents.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39486",
      "title": "The unexposed feature keyword isolation.tools.vmxDnDVersionGet.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39487",
      "title": "The unexposed feature keyword isolation.tools.guestDnDVersionSet.disable must be initialized to decrease the VMs potential attack vectors.",
      "description": "Because VMware virtual machines are designed to work on both vSphere, as well as, hosted virtualization platforms, such as Workstation and Fusion, there are some VMX parameters that do not apply when running on vSphere.  Although the functionality governed by these parameters is not exposed on ESX, explicitly disabling them will reduce the potential for vulnerabilities.  Disabling these features reduces the number of vectors through which a guest can attempt to influence the host, and thus may help prevent successful exploits.",
      "severity": "low"
    },
    {
      "id": "V-39488",
      "title": "The system must disable VIX messages from the VM.\n",
      "description": "The VIX API is a library for writing scripts and programs to manipulate virtual machines. If custom VIX programming is not used in the environment, then disable features to reduce the potential for vulnerabilities. Unprivileged code running in a VMware virtual machine (guest OS) may break out of the VMX process, and elevate from unprivileged guest code execution to host kernel code execution. The ability to send messages from the VM to the host is one of these features. Note that disabling this feature does \"not\" adversely affect the functioning of VIX operations that originate outside the guest, so certain VMware and 3rd party solutions that rely upon this capability should continue to work.",
      "severity": "low"
    },
    {
      "id": "V-39489",
      "title": "The system must disconnect unauthorized floppy devices.\n",
      "description": "Besides disabling unnecessary virtual devices from within the virtual machine, ensure no device is connected to a virtual machine if it is not required to be there. For example, serial and parallel ports are rarely used for virtual machines in a datacenter environment, and CD/DVD drives are usually connected only temporarily during software installation. For less commonly used devices that are not required, the parameter must be assigned a value of false. NOTE: The parameters listed are not sufficient to ensure a device is usable; other parameters are required to indicate specifically how each device is instantiated. Any enabled or connected device represents another potential attack channel.",
      "severity": "medium"
    },
    {
      "id": "V-39490",
      "title": "The system must disconnect unauthorized IDE devices.\n",
      "description": "Besides disabling unnecessary virtual devices from within the virtual machine, ensure no device is connected to a virtual machine if it is not required to be there. For example, serial and parallel ports are rarely used for virtual machines in a datacenter environment, and CD/DVD drives are usually connected only temporarily during software installation. For less commonly used devices that are not required, either the parameter should not be present or its value must be FALSE. NOTE: The parameters listed are not sufficient to ensure a device is usable; other parameters are required to indicate specifically how each device is instantiated. Any enabled or connected device represents another potential attack channel.\n",
      "severity": "medium"
    },
    {
      "id": "V-39491",
      "title": "The system must disconnect unauthorized parallel devices.\n",
      "description": "Besides disabling unnecessary virtual devices from within the virtual machine, ensure no device is connected to a virtual machine if it is not required to be there. For example, serial and parallel ports are rarely used for virtual machines in a datacenter environment, and CD/DVD drives are usually connected only temporarily during software installation. For less commonly used devices that are not required, either the parameter should not be present or its value must be FALSE. NOTE: The parameters listed are not sufficient to ensure a device is usable; other parameters are required to indicate specifically how each device is instantiated. Any enabled or connected device represents another potential attack channel.\n",
      "severity": "medium"
    },
    {
      "id": "V-39492",
      "title": "The system must disconnect unauthorized serial devices.\n",
      "description": "Besides disabling unnecessary virtual devices from within the virtual machine, ensure no device is connected to a virtual machine if it is not required to be there. For example, serial and parallel ports are rarely used for virtual machines in a datacenter environment, and CD/DVD drives are usually connected only temporarily during software installation. For less commonly used devices that are not required, either the parameter should not be present or its value must be FALSE. NOTE: The parameters listed are not sufficient to ensure a device is usable; other parameters are required to indicate specifically how each device is instantiated. Any enabled or connected device represents another potential attack channel.\n",
      "severity": "medium"
    },
    {
      "id": "V-39493",
      "title": "The system must disconnect unauthorized USB devices.\n",
      "description": "Besides disabling unnecessary virtual devices from within the virtual machine, ensure no device is connected to a virtual machine if it is not required to be there. For example, serial and parallel ports are rarely used for virtual machines in a datacenter environment, and CD/DVD drives are usually connected only temporarily during software installation. For less commonly used devices that are not required, either the parameter should not be present or its value must be FALSE. NOTE: The parameters listed are not sufficient to ensure a device is usable; other parameters are required to indicate specifically how each device is instantiated. Any enabled or connected device represents another potential attack channel.",
      "severity": "medium"
    },
    {
      "id": "V-39494",
      "title": "The system must limit sharing of console connections.\n",
      "description": "By default, remote console sessions can be connected to by more than one user at a time.  When multiple sessions are activated, each terminal window gets a notification about the new session. If an administrator in the VM logs in using a VMware remote console during their session, a non-administrator in the VM might connect to the console and observe the administrator's actions.  Also, this could result in an administrator losing console access to a virtual machine. For example, if a jump box is being used for an open console session and the admin loses connection to that box, then the console session remains open. Allowing two console sessions permits debugging via a shared session.  For highest security, only one remote console session at a time should be allowed.",
      "severity": "medium"
    },
    {
      "id": "V-39495",
      "title": "The system must limit VM logging records.\n",
      "description": "Use these settings to limit the total size and number of log files. Normally a new log file is created only when a host is rebooted, so the file can grow to be quite large. Ensure new log files are created more frequently by limiting the maximum size of the log files. If restricting the total size of logging data is wanted, VMware recommends saving 10 log files, each one limited to 1,000KB. Datastores are likely to be formatted with a block size of 2MB or 4MB, so a size limit too far below this size would result in unnecessary storage utilization. Each time an entry is written to the log, the size of the log is checked; if it is over the limit, the next entry is written to a new log. If the maximum number of log files already exists, when a new one is created, the oldest log file is deleted. A denial-of-service attack that avoids these limits might be attempted by writing an enormous log entry. But each log entry is limited to 4KB, so no log files are ever more than 4KB larger than the configured limit. A second option is to disable logging for the virtual machine. Disabling logging for a virtual machine makes troubleshooting challenging and support difficult. Do not consider disabling logging unless the log file rotation approach proves insufficient. Uncontrolled logging can lead to denial-of-service due to the datastore becoming filled.",
      "severity": "medium"
    },
    {
      "id": "V-39496",
      "title": "The system must limit VM logging record contents.\n",
      "description": "Use these settings to limit the total size and number of log files. Normally a new log file is created only when a host is rebooted, so the file can grow to be quite large. Ensure new log files are created more frequently by limiting the maximum size of the log files. If restricting the total size of logging data is wanted, VMware recommends saving 10 log files, each one limited to 1,000KB. Datastores are likely to be formatted with a block size of 2MB or 4MB, so a size limit too far below this size would result in unnecessary storage utilization. Each time an entry is written to the log, the size of the log is checked; if it is over the limit, the next entry is written to a new log. If the maximum number of log files already exists, when a new one is created, the oldest log file is deleted. A denial-of-service attack that avoids these limits might be attempted by writing an enormous log entry. But each log entry is limited to 4KB, so no log files are ever more than 4KB larger than the configured limit. A second option is to disable logging for the virtual machine. Disabling logging for a virtual machine makes troubleshooting challenging and support difficult. Do not consider disabling logging unless the log file rotation approach proves insufficient. Uncontrolled logging can lead to denial-of-service due to the datastore becoming filled.",
      "severity": "medium"
    },
    {
      "id": "V-39497",
      "title": "The system must limit informational messages from the VM to the VMX file.\n",
      "description": "The configuration file containing these name-value pairs is limited to a size of 1MB. If not limited, VMware tools in the guest OS are capable of sending a large and continuous data stream to the host. This 1MB capacity should be sufficient for most cases, but this value can change if necessary. The value can be increased if large amounts of custom information are being stored in the configuration file. The default limit is 1MB.",
      "severity": "low"
    },
    {
      "id": "V-39498",
      "title": "The system must minimize use of the VM console.\n",
      "description": "The VM console enables a connection to the console of a virtual machine, in effect seeing what a monitor on a physical server would show. The VM console also provides power management and removable device connectivity controls, which might potentially allow a malicious user to bring down a virtual machine. In addition, it also has a performance impact on the service console, especially if many VM console sessions are open simultaneously.",
      "severity": "medium"
    },
    {
      "id": "V-39499",
      "title": "The system must prevent unauthorized removal, connection and modification of devices by setting the isolation.device.connectable.disable keyword to true.\n",
      "description": "Normal users and processes-that is, users and processes without root or administrator privileges-within virtual machines have the capability to connect or disconnect devices, such as network adaptors and CD-ROM drives, as well as the ability to modify device settings. In general, the virtual machine settings should use editor or configuration editor to remove any unneeded or unused hardware devices. However, the device may need to be used again, so removing it is not always a good solution. In that case, prevent a user or running process in the virtual machine from connecting or disconnecting a device from within the guest operating system, as well as modifying devices, by adding the following parameters. By default, a rogue user with non-administrator privileges in a virtual machine can connect a disconnected CD-ROM drive and access sensitive information on the media left in the drive.",
      "severity": "medium"
    },
    {
      "id": "V-39500",
      "title": "The system must prevent unauthorized removal, connection and modification of devices.\n",
      "description": "Normal users and processes-that is, users and processes without root or administrator privileges-within virtual machines have the capability to connect or disconnect devices, such as network adaptors and CD-ROM drives, as well as the ability to modify device settings. In general, the virtual machine settings should use editor or configuration editor to remove any unneeded or unused hardware devices. However, the device may need to be used again, so removing it is not always a good solution. In that case, prevent a user or running process in the virtual machine from connecting or disconnecting a device from within the guest operating system, as well as modifying devices, by adding the following parameters. By default, a rogue user with non-administrator privileges in a virtual machine can connect a disconnected CD-ROM drive and access sensitive information on the media left in the drive.\n",
      "severity": "medium"
    },
    {
      "id": "V-39501",
      "title": "The system must not send host information to guests.\n",
      "description": "If enabled, a VM can obtain detailed information about the physical host. The default value for the parameter is FALSE. This setting should not be TRUE unless a particular VM requires this information for performance monitoring. An adversary potentially can use this information to inform further attacks on the host.",
      "severity": "medium"
    },
    {
      "id": "V-39503",
      "title": "The system must use secure protocols for virtual serial port access.\n",
      "description": "Serial ports are interfaces for connecting peripherals to the virtual machine. They are often used on physical systems to provide a direct, low-level connection to the console of a server, and a virtual serial port allows for the same access to a virtual machine. Serial ports allow for low-level access, which often does not have strong controls like logging or privileges.",
      "severity": "medium"
    },
    {
      "id": "V-39504",
      "title": "The system must use templates to deploy VMs whenever possible.\n",
      "description": "By capturing a hardened base operating system image (with no applications installed) in a template, ensure all virtual machines are created with a known baseline level of security. Then use this template to create other, application-specific templates, or use the application template to deploy virtual machines. Manual installation of the OS and applications into a VM introduces the risk of misconfiguration due to human or process error.\n",
      "severity": "low"
    },
    {
      "id": "V-39505",
      "title": "The system must control access to VMs through the dvfilter network APIs.\n",
      "description": "A VM must be configured explicitly to accept access by the dvfilter network API. This should be performed only for VMs that require the dvfilter network API. An attacker might compromise the VM by making use of this introspection channel.\n",
      "severity": "low"
    },
    {
      "id": "V-39506",
      "title": "The system must control access to VMs through VMsafe CPU/memory APIs.\n",
      "description": "The VMsafe CPU/memory API allows a security virtual machine to inspect and modify the contents of the memory and CPU registers on other VMs, for the purpose of detecting and preventing malware attacks. However, an attacker might compromise the VM by making use of this introspection channel; therefore it should be monitored for unauthorized usage of this API. A VM must be configured explicitly to accept access by the VMsafe CPU/memory API. This involves three parameters: one to enable the API, one to set the IP address used by the security virtual appliance on the introspection vSwitch, and one to set the port number for that IP address. If the VM is being protected by such a product, then make sure the latter two parameters are set correctly. This should be done only for specific VMs for which this protection is wanted.",
      "severity": "medium"
    },
    {
      "id": "V-39507",
      "title": "The system must control access to VMs through the VMsafe CPU/memory vmsafe.agentPort API.",
      "description": "The VMsafe CPU/memory API allows a security virtual machine to inspect and modify the contents of the memory and CPU registers on other VMs, for the purpose of detecting and preventing malware attacks. However, an attacker might compromise the VM by making use of this introspection channel; therefore it should be monitored for unauthorized usage of this API. A VM must be configured explicitly to accept access by the VMsafe CPU/memory API. This involves three parameters: one to enable the API, one to set the IP address used by the security virtual appliance on the introspection vSwitch, and one to set the port number for that IP address. If the VM is being protected by such a product, then make sure the latter two parameters are set correctly.  This should be done only for specific VMs for which this protection is wanted. \n",
      "severity": "medium"
    },
    {
      "id": "V-39508",
      "title": "The system must control access to VMs through the VMsafe CPU/memory vmsafe.enable API.",
      "description": "The VMsafe CPU/memory API allows a security virtual machine to inspect and modify the contents of the memory and CPU registers on other VMs, for the purpose of detecting and preventing malware attacks. However, an attacker might compromise the VM by making use of this introspection channel; therefore it should be monitored for unauthorized usage of this API. A VM must be configured explicitly to accept access by the VMsafe CPU/memory API. This involves three parameters: one to enable the API, one to set the IP address used by the security virtual appliance on the introspection vSwitch, and one to set the port number for that IP address. If the VM is being protected by such a product, then make sure the latter two parameters are set correctly.  This should be done only for specific VMs for which this protection is wanted.",
      "severity": "medium"
    }
  ]
}