Adobe Reader DC must Block Websites.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-65767	ARDC-CL-000025	SV-80257r3_rule		Medium

Description
Clicking any link to the Internet poses a potential security risk. Malicious websites can transfer harmful content or silently gather data. Acrobat Reader documents can connect to websites which can pose a potential threat to DoD systems and that functionality must be blocked. However, PDF document workflows that are trusted (e.g., DoD-created) can benefit from leveraging legitimate website access with minimal risk. Therefore, the ISSO may approve of website access and accept the risk if the access provides benefit and is a trusted site or the risk associated with accessing the site has been mitigated. Adobe Reader must block access to all websites that are not specifically allowed by ISSO risk acceptance. Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210

Description

Clicking any link to the Internet poses a potential security risk. Malicious websites can transfer harmful content or silently gather data. Acrobat Reader documents can connect to websites which can pose a potential threat to DoD systems and that functionality must be blocked. However, PDF document workflows that are trusted (e.g., DoD-created) can benefit from leveraging legitimate website access with minimal risk. Therefore, the ISSO may approve of website access and accept the risk if the access provides benefit and is a trusted site or the risk associated with accessing the site has been mitigated. Adobe Reader must block access to all websites that are not specifically allowed by ISSO risk acceptance. Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210

STIG	Date
Adobe Acrobat Reader DC Classic Track Security Technical Implementation Guide	2018-06-11

Details

Check Text ( C-66449r6_chk )
Verify the following registry configuration: Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\2015\FeatureLockDown\cDefaultLaunchURLPerms Value Name: iURLPerms Type: REG_DWORD Value: 1 Value: 0 – only with a documented ISSO risk acceptance If the value for iURLPerms is set to “0” and a documented ISSO risk acceptance approving access to the websites is provided, this is not a finding. If the value for “iURLPerms” is not set to “1” and “Type” configured to “REG_DWORD” or does not exist, this is a finding. GUI path: Edit >> Preferences >> Trust Manager >> In the "Internet Access from PDF Files outside the web browser" section >> Select "Change Settings" option >> In the "PDF Files may connect to web sites to share or get information" section >> Verify the radio button "Block PDF files access to all web sites" is selected and greyed out (locked). If "Custom setting" is checked, a documented risk acceptance approved by the ISSO/AO approving the websites must be provided, this is not a finding. Admin Template path: Computer Configuration >> Administrative Templates >> Adobe Reader DC Classic >> Preferences >> Trust Manager >> "Access to websites" must be set to "Enabled" and "Block PDF files access to all web sites" selected in the drop down box. If "Custom setting" is selected, a documented risk acceptance approved by the ISSO/AO approving the websites must be provided, this is not a finding. This policy setting requires the installation of the AcrobatDCClassic custom templates included with the STIG package. "AcrobatDCClassic.admx" and "AcrobatDCClassic.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

Check Text ( C-66449r6_chk )

Verify the following registry configuration:

Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\2015\FeatureLockDown\cDefaultLaunchURLPerms

Value Name: iURLPerms

Type: REG_DWORD

Value: 1

Value: 0 – only with a documented ISSO risk acceptance

If the value for iURLPerms is set to “0” and a documented ISSO risk acceptance approving access to the websites is provided, this is not a finding.

If the value for “iURLPerms” is not set to “1” and “Type” configured to “REG_DWORD” or does not exist, this is a finding.

GUI path: Edit >> Preferences >> Trust Manager >> In the "Internet Access from PDF Files outside the web browser" section >> Select "Change Settings" option >> In the "PDF Files may connect to web sites to share or get information" section >> Verify the radio button "Block PDF files access to all web sites" is selected and greyed out (locked).

If "Custom setting" is checked, a documented risk acceptance approved by the ISSO/AO approving the websites must be provided, this is not a finding.

Admin Template path: Computer Configuration >> Administrative Templates >> Adobe Reader DC Classic >> Preferences >> Trust Manager >> "Access to websites" must be set to "Enabled" and "Block PDF files access to all web sites" selected in the drop down box.

If "Custom setting" is selected, a documented risk acceptance approved by the ISSO/AO approving the websites must be provided, this is not a finding.

This policy setting requires the installation of the AcrobatDCClassic custom templates included with the STIG package. "AcrobatDCClassic.admx" and "AcrobatDCClassic.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

Fix Text (F-71837r3_fix)
Configure the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Adobe\Acrobat Reader\2015\FeatureLockDown\cDefaultLaunchURLPerms Value Name: iURLPerms Type: REG_DWORD Value: 1 If configuring the system to allow access to websites, obtain documented ISSO approvals and risk acceptance and set “iURLPerms” to “0”. Configure the policy value for Computer Configuration > Administrative Templates > Adobe Reader DC Classic > Preferences > Trust Manager > 'Access to websites' to 'Enabled' and select 'Block PDF files access to all web sites' in the drop down box. Select 'Custom setting' if needed and provide a documented risk acceptance approved by the ISSO/AO approving the websites. This policy setting requires the installation of the AcrobatDCClassic custom templates included with the STIG package. "AcrobatDCClassic.admx" and "AcrobatDCClassic.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

Fix Text (F-71837r3_fix)

Configure the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path:
\Software\Policies\Adobe\Acrobat Reader\2015\FeatureLockDown\cDefaultLaunchURLPerms

Value Name: iURLPerms
Type: REG_DWORD
Value: 1

If configuring the system to allow access to websites, obtain documented ISSO approvals and risk acceptance and set “iURLPerms” to “0”.

Configure the policy value for Computer Configuration > Administrative Templates > Adobe Reader DC Classic > Preferences > Trust Manager > 'Access to websites' to 'Enabled' and select 'Block PDF files access to all web sites' in the drop down box. Select 'Custom setting' if needed and provide a documented risk acceptance approved by the ISSO/AO approving the websites.

This policy setting requires the installation of the AcrobatDCClassic custom templates included with the STIG package. "AcrobatDCClassic.admx" and "AcrobatDCClassic.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.