Title

RSS Attachment Downloads (Cat II impact)

Discussion

This check verifies that attachments are prevented from being downloaded from RSS feeds.

Check Content

Note: For Windows XP, this check only applies if Internet Explorer 7 or later is installed. If the following registry value doesn’t exist or is not configured as specified this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Internet Explorer\Feeds\ Value Name: DisableEnclosureDownload Type: REG_DWORD Value: 1

Fix Text

Note: For Windows XP, this only applies if Internet Explorer 7 or later is installed. Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> RSS Feeds “Turn off downloading of enclosures” to “Enabled”.

Additional Identifiers

Rule ID: SV-16599r1_rule

Vulnerability ID: V-15682

Group Title: RSS Attachment Downloads

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.