Include the Internet with Safe Zones for Picture Download

Include the Internet with Safe Zones for Picture Download - Outlook

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17630	DTOO274 - Outlook	SV-18775r4_rule	ECSC-1	Medium

Description
Malicious e-mail senders can send HTML e-mail messages with embedded Web beacons, which are pictures and other content from external servers that can be used to track whether recipients open the messages. Viewing e-mail messages that contain Web beacons provides confirmation that the recipient's e-mail address is valid, which leaves the recipient vulnerable to additional spam and harmful e-mail. By default, Outlook 2007 does not download external content in HTML e-mail messages from untrusted senders via the Internet. If this configuration is changed, Outlook will display external content in all HTML e-mail messages received from the Internet, which could include Web beacons.

Description

Malicious e-mail senders can send HTML e-mail messages with embedded Web beacons, which are pictures and other content from external servers that can be used to track whether recipients open the messages. Viewing e-mail messages that contain Web beacons provides confirmation that the recipient's e-mail address is valid, which leaves the recipient vulnerable to additional spam and harmful e-mail. By default, Outlook 2007 does not download external content in HTML e-mail messages from untrusted senders via the Internet. If this configuration is changed, Outlook will display external content in all HTML e-mail messages received from the Internet, which could include Web beacons.

STIG	Date
Microsoft Outlook 2007	2015-09-17

Details

Check Text ( C-18918r7_chk )
The intent of this requirement (DTOO274) is to prevent content from the Internet from being automatically downloaded. This requirement (DTOO274) is coupled with DTOO272 which dictates whether content from Safe Zones is automatically downloaded or not. Since DTOO272 allows for content from Safe Zones to be automatically downloaded, this requirement (DTOO274) prevents the Internet from being considered as a Safe Zone. Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Internet in Safe Zones for Automatic Picture Download” is set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\Mail Criteria: If the value Internet is REG_DWORD = 0, this is not a finding.

Check Text ( C-18918r7_chk )

The intent of this requirement (DTOO274) is to prevent content from the Internet from being automatically downloaded.

This requirement (DTOO274) is coupled with DTOO272 which dictates whether content from Safe Zones is automatically downloaded or not. Since DTOO272 allows for content from Safe Zones to be automatically downloaded, this requirement (DTOO274) prevents the Internet from being considered as a Safe Zone.

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Internet in Safe Zones for Automatic Picture Download” is set to “Disabled”.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\Mail

Criteria: If the value Internet is REG_DWORD = 0, this is not a finding.

Fix Text (F-17540r2_fix)
The policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Internet in Safe Zones for Automatic Picture Download” will be set to “Disabled”.