Disable Plain Text Options for outbound email

Disable Plain Text Options for outbound email - Outlook

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17761	DTOO228 - Outlook	SV-18960r1_rule	ECSC-1	Medium

Description
If outgoing mail is formatted in certain ways, for example if attachments are encoded in UUENCODE format, attackers might manipulate the messages for their own purposes. If UUENCODE formatting is used, an attacker could manipulate the encoded attachment to bypass content filtering software. By default, Outlook 2007 automatically wraps plain text messages at 76 characters and uses the standard MIME format to encode attachments in plain text messages. However, these settings can be altered to allow e-mail to be read in plain text e-mail programs that use a non-standard line length or that cannot process MIME attachments.

Description

If outgoing mail is formatted in certain ways, for example if attachments are encoded in UUENCODE format, attackers might manipulate the messages for their own purposes. If UUENCODE formatting is used, an attacker could manipulate the encoded attachment to bypass content filtering software. By default, Outlook 2007 automatically wraps plain text messages at 76 characters and uses the standard MIME format to encode attachments in plain text messages. However, these settings can be altered to allow e-mail to be read in plain text e-mail programs that use a non-standard line length or that cannot process MIME attachments.

STIG	Date
Microsoft Outlook 2007	2015-09-17

Details

Check Text ( C-19024r1_chk )
The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Mail format -> Internet Formatting “Plain text options” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Common\MailSettings\ PlainWrapLen If the Registry key exists, this is a finding. OR The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Mail format -> Internet Formatting "Plain text -> options" will be set to "Enabled" where line length is "132" and that NO Check is visible in the "Encode all attachments in UUENCODE format when sending a plain text message" checkbox option. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Common\MailSettings\ PlainWrapLen Criteria: If the value PlainWrapLen is REG_DWORD = 132, this is not a finding. AND HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\Mail. Criteria: If the value Message Plain Format MIME is REG_DWORD = 1, this is not a finding. (Note: Any value for HKCU\Software\Policies\Microsoft\Office\12.0\Common\MailSettings\PlainWrapLen is acceptable.) NOTE: This check is compliant as long as it is matched and defined by setting exactly to one of the above methods.

Check Text ( C-19024r1_chk )

The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Mail format -> Internet Formatting “Plain text options” will be set to “Disabled”.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\12.0\Common\MailSettings\
PlainWrapLen

If the Registry key exists, this is a finding.

OR

The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Mail format -> Internet Formatting "Plain text -> options" will be set to "Enabled" where line length is "132" and that NO Check is visible in the "Encode all attachments in UUENCODE format when sending a plain text message" checkbox option.

Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Common\MailSettings\ PlainWrapLen

Criteria: If the value PlainWrapLen is REG_DWORD = 132, this is not a finding.

AND

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\Mail.

Criteria: If the value Message Plain Format MIME is REG_DWORD = 1, this is not a finding. (Note: Any value for HKCU\Software\Policies\Microsoft\Office\12.0\Common\MailSettings\PlainWrapLen is acceptable.)

NOTE: This check is compliant as long as it is matched and defined by setting exactly to one of the above methods.

Fix Text (F-17660r1_fix)
The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Mail format -> Internet Formatting "Plain text options" will be set to "Disabled" OR will be set to "Enabled, automatically wrap text option will be set to 132, and no check selection will be included in the Encode all attachments in UUENCODE format when sending a plain text message" checkbox option.

Fix Text (F-17660r1_fix)

The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Mail format -> Internet Formatting "Plain text options" will be set to "Disabled" OR will be set to "Enabled, automatically wrap text option will be set to 132, and no check selection will be included in the Encode all attachments in UUENCODE format when sending a plain text message" checkbox option.