Anonymous FTP users must not have access to interactive scripts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2270	WG430 IIS6	SV-38111r1_rule	ECCD-1 ECCD-2	Medium

Description
The directories containing the CGI scripts, such as PERL, must not be accessible to anonymous users via FTP. This applies to all directories containing scripts that can dynamically produce web pages in an interactive manner (i.e., scripts based upon user-provided input). Such scripts contain information that could be used to compromise a web service, access system resources, or deface a web site.

STIG	Date
IIS6 Site	2011-10-03

Details

Check Text ( C-37484r1_chk )
1. Open the IIS Manager. 2. For the site being reviewed, determine the directories where CGI, PERL, ASP, JS, or JSP scripts are located. 3. Determine if these locations are enabled for FTP access by looking under the FTP Sites folder within IIS Manager. 4. For directories with FTP enabled, right click on the directory > Select Properties > Select Directory Security > Select the Edit button beside Authentication and access control. If Enable anonymous access is checked, this is a finding.

Check Text ( C-37484r1_chk )

1. Open the IIS Manager.
2. For the site being reviewed, determine the directories where CGI, PERL, ASP, JS, or JSP scripts are located.
3. Determine if these locations are enabled for FTP access by looking under the FTP Sites folder within IIS Manager.
4. For directories with FTP enabled, right click on the directory > Select Properties > Select Directory Security > Select the Edit button beside Authentication and access control.

If Enable anonymous access is checked, this is a finding.

Fix Text (F-32732r1_fix)
Remove anonymous FTP access from directories where CGI, PERL, ASP, JS, or JSP scripts are located.