Detections
Analytics
WG440 IIS6 - Monitoring software must include CGI type files or equivalent programs.
Information
By their very nature, CGI type files permit the anonymous web user to interact with data and perhaps store data on the web server. In many cases, CGI scripts exercise system-level control over the server's resources. These files make appealing targets for the malicious user. If these files can be modified or exploited, the web server can be compromised. CGI or equivalent files must be monitored by a security tool alerting the Web Admin of any unauthorized changes.NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Configure the monitoring tool to include CGI type files or equivalent programs directory.See Also
http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip
Item Details
Audit Name: DISA STIG IIS 6.0 Server v6r16
References: CAT|II, Rule-ID|SV-38331r1_rule, STIG-ID|WG440_IIS6, Vuln-ID|V-2271
Plugin: Windows
Control ID: 142d27fb92575891b36b43f82814e147ca9d31ac8ba8cf0b9d312c9ef942cb51