All web-sites must be assigned a default Host header.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6724	WG520 IIS7	SV-32644r1_rule	ECSC-1	Low

Description
In order to reduce the possibility of DNS rebinding attacks and IP-based scans, all web-sites allowing HTTP/HTTPS over ports 80/443 will be assigned default Host headers.

STIG	Date
IIS 7.0 WEB SITE STIG	2014-03-25

Details

Check Text ( C-32868r1_chk )
1. Open the IIS Manager. 2. Click the site name under review. 3. Click Bindings in the Action Pane. 4. Ensure there are FQDN entries and IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. If not, this is a finding.

Fix Text (F-29019r1_fix)
1. Open the IIS Manager. 2. Click the site name under review. 3. Click Bindings in the Action Pane. 4. Click Edit to add FQDNs, IP addresses, and ports.