Check: WA00515 A22
APACHE Server 2.0 for Unix:
WA00515 A22
(in version v1 r5)
Title
Automatic directory indexing must be disabled. (Cat II impact)
Discussion
To identify the type of web servers and versions software installed it is common for attackers to scan for icons or special content specific to the server type and version. A simple request like http://example.com/icons/apache_pb2.png may tell the attacker that the server is Apache 2.2 as shown below. The many icons are used primary for auto indexing, which is recommended to be disabled.
Check Content
Enter the following command: /usr/local/Apache2.2/bin/httpd –M. This will provide a list of all loaded modules. If autoindex_module is found, this is a finding.
Fix Text
Edit the httpd.conf file and remove autoindex_module.
Additional Identifiers
Rule ID: SV-33219r1_rule
Vulnerability ID: V-26368
Group Title: WA00515
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
Number | Definition |
---|---|
No CCIs are assigned to this check |
Controls
Controls tied to check. These are derived from the CCIs shown above.
Number | Title |
---|---|
No controls are assigned to this check |