Web server software must be a vendor-supported version.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2246	WG190 A22	SV-36441r1_rule	ECSC-1	High

Description
Many vulnerabilities are associated with older versions of web server software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining the web server at a current version makes the efforts of a malicious user to exploit the web service more difficult.

STIG	Date
APACHE SITE 2.2 for Unix	2013-04-11

Details

Check Text ( C-29915r1_chk )
To determine the version of the Apache software that is running on the system. Use the command: httpd –v httpd2 -v If the version of Apache is not at the following version or higher, this is a finding. Apache 2.0 - Release 2.0.61 (Sep 2007) Apache 2.2 - Release 2.2.13 (Aug 2009) Apache 1.3 - Release 1.3.41 ( Jan 2008) NOTE: Apache has announced the end of life of the 1.3.x product line and this checklist will consider it non supported when the next security update is made to either the 2.0 or 2.2 product line, unless the version of 1.3.x is also updated. The current 2.0 and 2.2 releases are 2.0.64 and 2.2.15. When one of these changes, Apache 1.3.x would be considered non-supported software and a finding. NOTE: In some situations, the Apache software that is being used is supported by another vendor, such as Oracle in the case of the Oracle Application Server or IBMs HTTP Server. The versions of the software in these cases may not match the above mentioned version numbers. If the site can provide vendor documentation showing the version of the web server is supported, this would not be a finding.

Check Text ( C-29915r1_chk )

To determine the version of the Apache software that is running on the system. Use the command:

httpd –v
httpd2 -v

If the version of Apache is not at the following version or higher, this is a finding.

Apache 2.0 - Release 2.0.61 (Sep 2007)
Apache 2.2 - Release 2.2.13 (Aug 2009)

Apache 1.3 - Release 1.3.41 ( Jan 2008)

NOTE: Apache has announced the end of life of the 1.3.x product line and this checklist will consider it non supported when the next security update is made to either the 2.0 or 2.2 product line, unless the version of 1.3.x is also updated. The current 2.0 and 2.2 releases are 2.0.64 and 2.2.15. When one of these changes, Apache 1.3.x would be considered non-supported software and a finding.

NOTE: In some situations, the Apache software that is being used is supported by another vendor, such as Oracle in the case of the Oracle Application Server or IBMs HTTP Server. The versions of the software in these cases may not match the above mentioned version numbers. If the site can provide vendor documentation showing the version of the web server is supported, this would not be a finding.

Fix Text (F-2295r1_fix)
Install the current version of the web server software and maintain appropriate service packs and patches.