Title

Web server and/or operating system information must be protected. (Cat III impact)

Discussion

The web server response header of an HTTP response can contain several fields of information including the requested HTML page. The information included in this response can be web server type and version, operating system and version, and ports associated with the web server. This provides the malicious user valuable information without the use of extensive tools.

Check Content

Query the SA regarding the publishing of the web server or operating system information. The SA should be able to show that the web server is configured to not display the host operating system of the web server. The reviewer should review the following registry key using the registry editor: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\DisableServerHeader (REG-DWORD) If the value is not set to 1, this is a finding.

Fix Text

Set the following registry key to 1: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\DisableServerHeader (REG_DWORD)

Additional Identifiers

Rule ID: SV-30051r1_rule

Vulnerability ID: V-6724

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.