All interactive programs must be placed in a designated directory with appropriate permissions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2228	WG400 W22	SV-36644r1_rule	DCPA-1	Medium

Description
CGI scripts represents one of the most common and exploitable means of compromising a web server. By definition, CGI are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not otherwise limited unless the SA or Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs and use the network. CGI programs can be written in any available programming language. C, PERL, PHP, Javascript, VBScript and shell (sh, ksh, bash) are popular choices.

Description

CGI scripts represents one of the most common and exploitable means of compromising a web server. By definition, CGI are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not otherwise limited unless the SA or Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs and use the network. CGI programs can be written in any available programming language. C, PERL, PHP, Javascript, VBScript and shell (sh, ksh, bash) are popular choices.

STIG	Date
APACHE SITE 2.0 for Windows	2011-12-12

Details

Check Text ( C-35736r1_chk )
To preclude access to the servers root directory, ensure the following directive is in the httpd.conf file. This entry will also stop users from setting up .htaccess files which can override security features configured in httpd.conf. AllowOverride None If the AllowOverride None is not set, this is a finding.

Fix Text (F-30977r1_fix)
Enter the statement above into httpd.conf file for all web site root directories.