UCF STIG Viewer Logo

Unspecified file extensions must not be allowed to execute on the production web server.


Overview

Finding ID Version Rule ID IA Controls Severity
V-25999 WA000-WI6100 SV-32650r2_rule Medium
Description
By allowing unspecified file extensions to execute, the web servers attack surface is significantly increased. This increased risk can be reduced by only allowing specific ISAPI extensions or CGI extensions to run on the web server.
STIG Date
IIS 7.0 WEB SERVER STIG 2017-12-21

Details

Check Text ( C-32871r1_chk )
1. Open the IIS Manager.
2. Click the Server.
3. Double-click the ISAPI and CGI restrictions icon.
4. Click Edit Feature Settings and verify the CGI and ISAPI Modules are NOT checked. If they are checked, this is a finding.
Fix Text (F-29023r1_fix)
1. Open the IIS Manager.
2. Click the Server.
3. Double-click the ISAPI and CGI restrictions icon.
4. Click Edit Feature Settings and uncheck the CGI and ISAPI Modules check boxes.