The production web-site must be configured to prevent detailed HTTP error pages from being sent to remote clients.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-26031	WA000-WI6165	SV-32682r2_rule		Low

Description
HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.

STIG	Date
IIS 7.0 Site STIG	2019-05-15

Details

Check Text ( C-32885r1_chk )
1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click the Error Pages icon. 4. Click each error message and click Edit Feature Setting from the Actions Pane. If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.

Fix Text (F-29033r1_fix)
1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click the Error Pages icon. 4. Click each error message and click Edit Feature Setting from the Actions Pane; set each error message to “Detailed errors for local requests and custom error pages for remote requests”.