STIGQter: STIG Summary: APACHE 2.2 Server for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

HTTP request methods must be limited.

DISA Rule

SV-33236r2_rule

Vulnerability Number

V-26396

Group Title

WA00565

Rule Version

WA00565 A22

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Edit the httpd.conf file and add the following entries for every enabled directory except root.

Order allow,deny

<LimitExcept GET POST OPTIONS>
Deny from all
</LimitExcept>

Check Contents

Note: If HTTP commands (GET, PUT, POST, DELETE) are not being used and server is solely configured as a proxy server, this is Not Applicable.

Enter the following command:

more /usr/local/apache2/conf/httpd.conf

For every enabled <Directory> directive (except root), ensure the following entry exists:

Order allow,deny

<LimitExcept GET POST OPTIONS>
Deny from all
</LimitExcept>

If the statement above is found in the root directory statement (i.e. <Directory />), this is a finding.

If the statement above is found enabled but without the appropriate LimitExcept or Order statement, this is a finding.

If the statement is not found inside an enabled <Directory> directive, this is a finding.

Note: If the LimitExcept statement above is operationally limiting. This should be explicitly documented with the Web Manager, at which point this can be considered not a finding.

Vulnerability Number

V-26396

Documentable

False

Rule Version

WA00565 A22

Severity Override Guidance

Note: If HTTP commands (GET, PUT, POST, DELETE) are not being used and server is solely configured as a proxy server, this is Not Applicable.

Enter the following command:

more /usr/local/apache2/conf/httpd.conf

For every enabled <Directory> directive (except root), ensure the following entry exists:

Order allow,deny

<LimitExcept GET POST OPTIONS>
Deny from all
</LimitExcept>

If the statement above is found in the root directory statement (i.e. <Directory />), this is a finding.

If the statement above is found enabled but without the appropriate LimitExcept or Order statement, this is a finding.

If the statement is not found inside an enabled <Directory> directive, this is a finding.

Note: If the LimitExcept statement above is operationally limiting. This should be explicitly documented with the Web Manager, at which point this can be considered not a finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

158

Comments