The Content Location header must not contain proprietary IP addresses.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-13702	WA000-WI120 IIS7	SV-32514r1_rule	ECSC-1	Low

Description
When using static HTML pages, a Content-Location header is added to the response. The Internet Information Server (IIS) Content-Location may reference the IP address of the server, rather than the Fully Qualified Domain Name (FQDN) or Hostname. This header may expose internal IP addresses that are usually hidden or masked behind a Network Address Translation (NAT) firewall or proxy server. There is a value that can be modified in the IIS metabase to change the default behavior from exposing IP addresses, to sending the FQDN instead.

Description

When using static HTML pages, a Content-Location header is added to the response. The Internet Information Server (IIS) Content-Location may reference the IP address of the server, rather than the Fully Qualified Domain Name (FQDN) or Hostname. This header may expose internal IP addresses that are usually hidden or masked behind a Network Address Translation (NAT) firewall or proxy server. There is a value that can be modified in the IIS metabase to change the default behavior from exposing IP addresses, to sending the FQDN instead.

STIG	Date
IIS 7.0 WEB SITE STIG	2014-12-05

Details

Check Text ( C-32823r1_chk )
1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click Configuration Editor. 4. From the drop-down box select system.webserver serverRuntime. If alternateHostName has no assigned value, this is a finding.

Fix Text (F-28934r1_fix)
1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click Configuration Editor. 4. Click the drop-down box located at the top of the Configuration Editor Pane. 5. Scroll until you find system.webserver/serverRuntime, double-click the element, and add the appropriate value.