A compiler must not be installed on a production web server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2236	WG080 IIS6	SV-38190r1_rule	ECSC-1	Medium

Description
The presence of a compiler on a production server facilitates the malicious user’s task of creating custom versions of programs and installing Trojan Horses or viruses.

STIG	Date
IIS6 Server	2011-09-26

Details

Check Text ( C-37633r1_chk )
Using Windows Explorer, search the system for the existence of known compilers such as msc.exe, msvc.exe, Python.exe, javac.exe, Lcc-win32.exe, or equivalent. If a compiler is found on the production server, this is a finding. NOTE: This check does not prohibit the use of the .Net Framework. This does not prohibit the use of the java compiler for Oracle. NOTE: ColdFusion would not be considered a compiler as long as the site is not using the tools for development work.

Check Text ( C-37633r1_chk )

Using Windows Explorer, search the system for the existence of known compilers such as msc.exe, msvc.exe, Python.exe, javac.exe, Lcc-win32.exe, or equivalent.

If a compiler is found on the production server, this is a finding.

NOTE: This check does not prohibit the use of the .Net Framework. This does not prohibit the use of the java compiler for Oracle.
NOTE: ColdFusion would not be considered a compiler as long as the site is not using the tools for development work.

Fix Text (F-32874r1_fix)
Remove any compiler programs found on the production web server.