STIGQter: STIG Summary: Microsoft Outlook 2013 STIG Version: 1 Release: 13 Benchmark Date: 26 Oct 2018:

External content and pictures in HTML email must be displayed.

DISA Rule

SV-54042r3_rule

Vulnerability Number

V-17672

Group Title

DTOO270 - External Pictures & content

Rule Version

DTOO270

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Security -> Automatic Picture Download Settings "Display pictures and external content in HTML e-mail" to "Enabled".

Check Contents

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2013 >> Security >> Automatic Picture Download Settings "Display pictures and external content in HTML e-mail" is set to "Enabled".

NOTE: When this setting is Enabled, Outlook 2007 does block automatic download of content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\outlook\options\mail

Criteria: If the value BlockExtContent is REG_DWORD = 1, this is not a finding.

Vulnerability Number

V-17672

Documentable

False

Rule Version

DTOO270

Severity Override Guidance

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2013 >> Security >> Automatic Picture Download Settings "Display pictures and external content in HTML e-mail" is set to "Enabled".

NOTE: When this setting is Enabled, Outlook 2007 does block automatic download of content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\outlook\options\mail

Criteria: If the value BlockExtContent is REG_DWORD = 1, this is not a finding.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

2482

Comments