Title

The web server must use a vendor-supported version of the web server software. (Cat I impact)

Discussion

The web server Software, IIS 6, is no longer supported by Microsoft for security updates and is not evaluated or updated for vulnerabilities, leaving it open to potential attack. Organizations must transition to a supported IIS release to ensure continued support.

Check Content

Microsoft IIS 6 mainstream support ended 13 July 2010, and extended support ended 14 July 2015. If Microsoft IIS 6 is installed on a system, this is a finding.

Fix Text

Upgrade Microsoft IIS to a supported version.

Additional Identifiers

Rule ID: SV-38193r2_rule

Vulnerability ID: V-2246

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.