STIGQter: STIG Summary: APACHE 2.2 Site for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

All interactive programs (CGI) must be placed in a designated directory with appropriate permissions.

DISA Rule

SV-6928r1_rule

Vulnerability Number

V-2228

Group Title

WG400

Rule Version

WG400 A22

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Ensure the CGI (or equivalent i.e. scripts) directory has access controls IAW the WEB Services STIG.

Check Contents

To preclude access to the servers root directory, ensure the following directive is in the httpd.conf file. This entry will also stop users from setting up .htaccess files which can override security features configured in httpd.conf.

<DIRECTORY /[website root dir]>
AllowOverride None
</DIRECTORY>

If the AllowOverride None is not set, this is a finding.

Vulnerability Number

V-2228

Documentable

False

Rule Version

WG400 A22

Severity Override Guidance

To preclude access to the servers root directory, ensure the following directive is in the httpd.conf file. This entry will also stop users from setting up .htaccess files which can override security features configured in httpd.conf.

<DIRECTORY /[website root dir]>
AllowOverride None
</DIRECTORY>

If the AllowOverride None is not set, this is a finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

161

Comments