STIGQter: STIG Summary: APACHE 2.2 Server for Windows Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 25 Jan 2019:

Web server and/or operating system information must be protected.

DISA Rule

SV-33098r1_rule

Vulnerability Number

V-6724

Group Title

WG520

Rule Version

WG520 W22

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Ensure the web server is configured to not advertise the web server and operating system information to the client.

Check Contents

Locate the httpd.conf file.

Open the httpd.conf file with an editor such as Notepad, and search for the following uncommented directive: ServerTokens

The directive ServerTokens must be set to “Prod” (ex. ServerTokens Prod). This directive controls whether Server response header field that is sent back to clients that includes a description of the OS-type of the server as well as information about compiled-in modules.

If the web server or operating system information is sent to the client via the server response header, this is a finding. If the directive does not exist, this would be a finding as it defaults to Full.

Vulnerability Number

V-6724

Documentable

False

Rule Version

WG520 W22

Severity Override Guidance

Locate the httpd.conf file.

Open the httpd.conf file with an editor such as Notepad, and search for the following uncommented directive: ServerTokens

The directive ServerTokens must be set to “Prod” (ex. ServerTokens Prod). This directive controls whether Server response header field that is sent back to clients that includes a description of the OS-type of the server as well as information about compiled-in modules.

If the web server or operating system information is sent to the client via the server response header, this is a finding. If the directive does not exist, this would be a finding as it defaults to Full.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

158

Comments