Title

The UriMaxUriBytes registry entry must be set properly. (Cat II impact)

Discussion

Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The UriMaxUriBytes key is used to set size limits on what is cached in the kernel response cache. Setting this value to large may cause performance or Denial of Service conditions on the web server.

Check Content

1. Open the registry editor. 2. Navigate to the following location in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters. 3. Ensure the value for the UriMaxUriBytes key is set to REG_DWORD 262144 (or less). If the registry value is not set to 262144 (or less) or is missing, this is a finding.

Fix Text

1. Open the registry editor. 2. Navigate to the following location in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters. 3. Set the value for the UriMaxUriBytes key to REG_DWORD 262144 or add the key and set it to REG_DWORD 262144.

Additional Identifiers

Rule ID: SV-38167r1_rule

Vulnerability ID: V-13721

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.