documentation_complete: true


title: 'Disable Avahi Server Software'

description: |-
    {{{ describe_service_disable(service="avahi-daemon") }}}

rationale: |-
    Because the Avahi daemon service keeps an open network
    port, it is subject to network attacks. Its functionality
    is convenient but is only appropriate if the local network
    can be trusted.

severity: medium

identifiers:
    cce@rhel8: CCE-82188-4
    cce@rhel9: CCE-90824-4
    cce@rhel10: CCE-90062-1
    cce@sle12: CCE-91691-6
    cce@sle15: CCE-91321-0
    cce@slmicro5: CCE-93930-6

references:
    cis-csc: 11,14,3,9
    cis@sle12: 2.2.3
    cis@sle15: 2.2.3
    cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS05.02,DSS05.05,DSS06.06
    isa-62443-2009: 4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 7.6'
    iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.9.1.2
    nist: CM-7(a),CM-7(b),CM-6(a)
    nist-csf: PR.IP-1,PR.PT-3

ocil_clause: |-
    {{{ ocil_clause_service_disabled(service="avahi-daemon") }}}

ocil: |-
    {{{ ocil_service_disabled(service="avahi-daemon") }}}

platform: system_with_kernel and package[avahi]

template:
    name: service_disabled
    vars:
        servicename: avahi-daemon
        packagename: avahi
        packagename@ubuntu2204: avahi-daemon
        packagename@ubuntu2404: avahi-daemon
