STIGQter STIGQter: STIG Summary: APACHE 2.2 Server for Windows Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 25 Jan 2019:

Administrators must be the only users allowed access to the directory tree, the shell, or other operating system functions and utilities.

DISA Rule

SV-36509r1_rule

Vulnerability Number

V-2247

Group Title

WG200

Rule Version

WG200 W22

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities.

Check Contents

Windows 2008 servers may be impacted by this check. If the SA or the web administrator can demonstrate that this requirement will adversely affect the web server by providing vendor documentation, this check is not applicable.

Search all of the system’s hard drives for the command.com and cmd.exe files. The allowed permissions on these files are:

System Full Control
Administrators Full Control

Examine account access and any group membership access to these files.

If any non-administrator account, group membership, or service ID has any access to any command.com or cmd.exe files and the access is documented as mission critical, this is not a finding.

Examine access to operating system configuration files, scripts, utilities, privileges, and functions.

If any non-administrator account, group membership, or service ID has any access to any of these operating system components and the access is documented as mission critical, this is not a finding.

If any non-administrator account, group membership, or service ID has undocumented access to any listed file or operating system component, this is a finding.

Vulnerability Number

V-2247

Documentable

False

Rule Version

WG200 W22

Severity Override Guidance

Windows 2008 servers may be impacted by this check. If the SA or the web administrator can demonstrate that this requirement will adversely affect the web server by providing vendor documentation, this check is not applicable.

Search all of the system’s hard drives for the command.com and cmd.exe files. The allowed permissions on these files are:

System Full Control
Administrators Full Control

Examine account access and any group membership access to these files.

If any non-administrator account, group membership, or service ID has any access to any command.com or cmd.exe files and the access is documented as mission critical, this is not a finding.

Examine access to operating system configuration files, scripts, utilities, privileges, and functions.

If any non-administrator account, group membership, or service ID has any access to any of these operating system components and the access is documented as mission critical, this is not a finding.

If any non-administrator account, group membership, or service ID has undocumented access to any listed file or operating system component, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

158

Comments