IDMS must suppress security-related messages so that no information is returned that can be exploited.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-251624 | SRG-APP-000266-DB-000162 | IDMS-DB-000530 | SV-251624r961167_rule | 2024-09-13 | 2 |
Description
Error messages issued to non-privileged users may have contents that should be considered confidential. IDMS should be configured so that these messages are not issued to those users.
ℹ️ Check
Log on to IDMS DC system and issue "DCPROFIL". Scroll to the OPTION FLAGS screen. If "OPT00051" is not listed, this is a finding.
For IDMS LOG messages, if OPT00226 is not listed, this is a finding.
✔️ Fix
Reassemble, relink, and reload (V NC) RHDCOPTF with #DEFOPTF OPT00051 (for messages sent to user) and optional #DEFOPTF OPT00226 (for messages sent to IDMS log).