CME-902
Disable Unused Network Services
Description
Disables and masks unnecessary listening services (rpcbind, avahi-daemon, cups, postfix on non-mail servers). Each removed service eliminates an attack surface.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Vector (AV) | N → L | Fewer network-accessible services means fewer remote attack vectors |
CWE Relationships
Verification
List listening services and verify only necessary ones are active
$ ss -tlnp | grep -v '127.0.0.1\|::1'
# Expected: Only expected services
# Expected: Only expected services
Platform: linux
$ Get-NetTCPConnection -State Listen | Where-Object { $_.LocalAddress -ne '127.0.0.1' -and $_.LocalAddress -ne '::1' } | Measure-Object | Select-Object -ExpandProperty Count
# Expected: Only expected services
# Expected: Only expected services
Platform: windows
Applicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| microsoft | windows |
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*
|
All | applicable |