OHS must limit access to the Dynamic Monitoring Service (DMS).
An XCCDF Rule
Description
The Oracle Dynamic Monitoring Service (DMS) enables application developers, support analysts, system administrators, and others to measure application specific performance information. If OHS allows any machine to connect and monitor performance, an attacker could connect and gather information that could be used to cause a DoS for OHS. Information that is shared could also be used to further an attack to other servers and devices through trusted relationships.
- ID
- SV-221430r879887_rule
- Version
- OH12-1X-000192
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/admin.conf with an editor.
2. Search for the "Allow" directive within the "<Location /dms/>" virtual host configuration scope.
3. Set the "Allow" directive to "from 127.0.0.1".