All web-sites must be assigned a default Host header.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6724	WG520 IIS7	SV-32644r4_rule		Low

Description
In order to reduce the possibility of DNS rebinding attacks and IP-based scans, all web-sites allowing HTTP/HTTPS over ports 80/443 will be assigned default Host headers.

STIG	Date
IIS 7.0 WEB SITE STIG	2017-06-28

Details

Check Text ( C-32868r3_chk )
1. Open the IIS Manager. 2. In the “Connections” pane, expand the “Sites” node in the tree. Select the site name under review. 3. In the “Actions” pane, select “Bindings”. 4. Each site should have a hostname entry (at a minimum) and specific IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. If not, this is a finding.

Fix Text (F-29019r2_fix)
1. Open the IIS Manager. 2. In the “Connections” pane, expand the “Sites” node in the tree. Select the site name under review. 3. In the “Actions” pane, select “Bindings”. 4. In the “Site Bindings” dialog box, select the binding to add a host header and then click “Edit” or “Add”. 5. In the “Host” name box, type a host header for the site for both port 80 for HTTP and port 443 for HTTPS. 6. Click “OK”.

Fix Text (F-29019r2_fix)

1. Open the IIS Manager.
2. In the “Connections” pane, expand the “Sites” node in the tree. Select the site name under review.
3. In the “Actions” pane, select “Bindings”.
4. In the “Site Bindings” dialog box, select the binding to add a host header and then click “Edit” or “Add”.
5. In the “Host” name box, type a host header for the site for both port 80 for HTTP and port 443 for HTTPS.
6. Click “OK”.