Configure the "include Intranet" with Safe Zones for automatic picture downloads.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17634	DTOO275 - Outlook	SV-18779r4_rule	ECSC-1	Medium

Description
Malicious e-mail senders can send HTML e-mail messages with embedded Web beacons, which are pictures and other content from external servers that can be used to track whether recipients open the messages. Viewing e-mail messages with Web beacons in them provides confirmation that the recipient's e-mail address is valid, which leaves the recipient vulnerable to additional spam and harmful e-mail. By default, Outlook 2007 does not download external content in HTML e-mail messages from untrusted senders over the local intranet. If this configuration is changed, Outlook will display external content in all HTML e-mail messages received via the local intranet, which could include Web beacons.

Description

Malicious e-mail senders can send HTML e-mail messages with embedded Web beacons, which are pictures and other content from external servers that can be used to track whether recipients open the messages. Viewing e-mail messages with Web beacons in them provides confirmation that the recipient's e-mail address is valid, which leaves the recipient vulnerable to additional spam and harmful e-mail. By default, Outlook 2007 does not download external content in HTML e-mail messages from untrusted senders over the local intranet. If this configuration is changed, Outlook will display external content in all HTML e-mail messages received via the local intranet, which could include Web beacons.

STIG	Date
Microsoft Outlook 2007	2015-09-17

Details

Check Text ( C-18919r5_chk )
The intent of this requirement (DTOO275) is to prevent content from the Intranet from being automatically downloaded. This requirement (DTOO275) is coupled with DTOO272 which dictates whether content from Safe Zones is automatically downloaded or not. Since DTOO272 allows for content from Safe Zones to be automatically downloaded, this requirement (DTOO275) prevents the Intranet from being considered as a Safe Zone. Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Intranet in Safe Zones for Automatic Picture Download” is set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\Mail Criteria: If the value Intranet is REG_DWORD = 0, this is not a finding.

Check Text ( C-18919r5_chk )

The intent of this requirement (DTOO275) is to prevent content from the Intranet from being automatically downloaded.

This requirement (DTOO275) is coupled with DTOO272 which dictates whether content from Safe Zones is automatically downloaded or not. Since DTOO272 allows for content from Safe Zones to be automatically downloaded, this requirement (DTOO275) prevents the Intranet from being considered as a Safe Zone.

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Intranet in Safe Zones for Automatic Picture Download” is set to “Disabled”.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\Mail

Criteria: If the value Intranet is REG_DWORD = 0, this is not a finding.

Fix Text (F-17541r2_fix)
The policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Intranet in Safe Zones for Automatic Picture Download” will be set to “Disabled”.