The IIS 8.5 web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76763	IISW-SV-000155	SV-91459r2_rule		Medium

Description
Several vulnerabilities are associated with older versions of web server software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining the web server at a current version makes the efforts of a malicious user more difficult.

STIG	Date
IIS 8.5 Server Security Technical Implementation Guide	2018-04-05

Details

Check Text ( C-76419r2_chk )
Determine the most recent patch level of the IIS 8.5 software, as posted on the Microsoft website. Open the IIS 8.5 Manager. Click "Help", and select "About Internet Information Services". If the version is more than one version behind the most recent patch level, this is a finding.

Fix Text (F-83459r1_fix)
Install the current version of the web server software and maintain appropriate service packs and patches.