STIGQter STIGQter: STIG Summary: Microsoft DotNet Framework 4.0 Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

Remoting Services TCP channels must utilize authentication and encryption.

DISA Rule

SV-225237r615940_rule

Vulnerability Number

V-225237

Group Title

SRG-APP-000219

Rule Version

APPNET0071

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure encryption and message integrity are used for TCP remoting channels.

TCP remoting connections are protected via the secure=true configuration parameter.
<channels>
<channel ref="tcp" secure="true" />
</channels>

Include the secure="true" flag in the channel ref parameter of the machine.config and [application name].exe.config file if the [application name].exe.config file exists on the system.

Check Contents

Check the machine.config and the [application executable name].exe.config configuration files.

For 32 bit systems, the "machine.config" file is contained in the following folder. %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config

For 64 bit systems, the "machine.config" file is contained in the following folder. %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config.

Microsoft specifies locating the application config file in the same folder as the application executable (.exe) file. However, the developer does have the capability to specify a different location when the application is compiled. Therefore, if the config file is not found in the application home folder, a search of the system is required. If the [application name].exe.config file is not found on the system, then only a check of the machine.config file is required.

Sample machine/application config file:

<application name=“remoteserver”>
<service>
<activated type=“sample.my.object, myobjects”/>
</service>
<channels>
<channel ref=“tcp server” port=“6134”/>
</channels>
</application>

<serverProviders>
<provider ref="wsdl" />
<formatter ref="soap" typeFilterLevel="Full" />
<formatter ref="binary" typeFilterLevel="Full" />
</serverProviders>

Microsoft provides 3 "channels" that are used for remoting connectivity. They are the HTTP, TCP, and IPC channels. The channel that is used is specified via the <channels> element in the config file.

TCP channel example:
<channel ref=“tcp” port=“6134” secure="true"/>

The TCP Channel provides encryption and message integrity when the 'secure' flag is set to true as shown in the above example.

If the secure flag is not set to "true" for the TCP channel, this is a finding.

Vulnerability Number

V-225237

Documentable

False

Rule Version

APPNET0071

Severity Override Guidance

Check the machine.config and the [application executable name].exe.config configuration files.

For 32 bit systems, the "machine.config" file is contained in the following folder. %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config

For 64 bit systems, the "machine.config" file is contained in the following folder. %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config.

Microsoft specifies locating the application config file in the same folder as the application executable (.exe) file. However, the developer does have the capability to specify a different location when the application is compiled. Therefore, if the config file is not found in the application home folder, a search of the system is required. If the [application name].exe.config file is not found on the system, then only a check of the machine.config file is required.

Sample machine/application config file:

<application name=“remoteserver”>
<service>
<activated type=“sample.my.object, myobjects”/>
</service>
<channels>
<channel ref=“tcp server” port=“6134”/>
</channels>
</application>

<serverProviders>
<provider ref="wsdl" />
<formatter ref="soap" typeFilterLevel="Full" />
<formatter ref="binary" typeFilterLevel="Full" />
</serverProviders>

Microsoft provides 3 "channels" that are used for remoting connectivity. They are the HTTP, TCP, and IPC channels. The channel that is used is specified via the <channels> element in the config file.

TCP channel example:
<channel ref=“tcp” port=“6134” secure="true"/>

The TCP Channel provides encryption and message integrity when the 'secure' flag is set to true as shown in the above example.

If the secure flag is not set to "true" for the TCP channel, this is a finding.

Check Content Reference

M

Target Key

4213

Comments