CCE-91780-7Platform: cpe:/o:apple:mac_os_x:10.13 | Date: (C)2018-02-22 (M)2023-07-04 |
Prompt Password for all open sessions
The sudo command must be configured to prompt for the administrator user's password at least once in each newly opened Terminal window or remote login session, as this prevents a malicious user from taking advantage of an unlocked computer or an abandoned login session to bypass the normal password prompt requirement. Without the tty_tickets option, all open local and remote login sessions would be authenticated to use sudo without a password for the duration of the configured password timeout window.
Parameter:
[yes/no]
Technical Mechanism:
To check if the tty_tickets option is set for sudo, run the following command:
sudo grep tty_tickets /etc/sudoers
If there is no result, this is a finding.
CCSS Severity: | CCSS Metrics: |
CCSS Score : 8.4 | Attack Vector: LOCAL |
Exploit Score: 2.5 | Attack Complexity: LOW |
Impact Score: 5.9 | Privileges Required: NONE |
Severity: HIGH | User Interaction: NONE |
Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Scope: UNCHANGED |
| Confidentiality: HIGH |
| Integrity: HIGH |
| Availability: HIGH |
| |
References: Resource Id | Reference |
---|
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:44326 |