STIGQter STIGQter: STIG Summary: APACHE 2.2 Server for Windows Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 25 Jan 2019:

The HTTP request line must be limited.

DISA Rule

SV-33011r3_rule

Vulnerability Number

V-13739

Group Title

WA000-WWA066

Rule Version

WA000-WWA066 W22

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Set LimitRequestLine to 8190 or approved value. If no LimitRequestLine directives exist, explicitly add the directive and set to 8190.

Check Contents

Locate the Apache httpd.conf file.

Open the httpd.conf file with an editor such as notepad, and search for the following uncommented directive: LimitRequestLine

Every enabled LimitRequestLine value needs to be 8190. If any directive is set improperly, this is a Finding.
If no LimitRequestLine directives exist, this is a Finding. Although the default value is 8190, this directive must be explicitly set.

NOTE: This value may vary in size based on the application that is being supported by the web server. This vulnerability can be documented locally by the ISSM/ISSO if the site has operational reasons for an increased or decreased value. If the ISSM/ISSO has approved this change in writing, this should be marked as Not a Finding.

Vulnerability Number

V-13739

Documentable

False

Rule Version

WA000-WWA066 W22

Severity Override Guidance

Locate the Apache httpd.conf file.

Open the httpd.conf file with an editor such as notepad, and search for the following uncommented directive: LimitRequestLine

Every enabled LimitRequestLine value needs to be 8190. If any directive is set improperly, this is a Finding.
If no LimitRequestLine directives exist, this is a Finding. Although the default value is 8190, this directive must be explicitly set.

NOTE: This value may vary in size based on the application that is being supported by the web server. This vulnerability can be documented locally by the ISSM/ISSO if the site has operational reasons for an increased or decreased value. If the ISSM/ISSO has approved this change in writing, this should be marked as Not a Finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

158

Comments