Check: WG210 A24
Apache Site 2.4 Unix:
WG210 A24
(in version v1 r1)
Title
Web content directories must not be anonymously shared. (Cat II impact)
Discussion
Sharing web content is a security risk when a web server is involved. Users accessing the share anonymously could experience privileged access to the content of such directories. Network sharable directories expose those directories and their contents to unnecessary access. Any unnecessary exposure increases the risk that someone could exploit that access and either compromises the web content or cause web server performance problems.
Check Content
To view the DocumentRoot enter the following command: find / -name httpd.conf -print -exec grep -H -i "DocumentRoot" {} \; To view the ServerRoot enter the following command: find / -name httpd.conf -print -exec grep -H -i "ServerRoot" {} \; Note the location(s) following the DocumentRoot and ServerRoot directives. Enter the following commands to determine if file sharing is running: ps -ef | grep nfs, ps -ef | grep smb If results are returned, determine the shares and confirm they are not in the same directory as listed above, If they are, this is a finding.
Fix Text
Remove the shares from the applicable directories.
Additional Identifiers
Rule ID:
Vulnerability ID: V-2226
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
No CCIs are assigned to this check |
Controls
Number | Title |
---|---|
No controls are assigned to this check |