Title

Anonymous access to the Registry is not restricted. (Cat I impact)

Discussion

This is a Category I finding, because this vulnerability allows an anonymous individual read-access and write-access to some parts of the Registry. The permissions set for the Winreg subkey determine who can remotely connect to a registry. If this subkey does not exist, all users can remotely connect to the registry. To remotely connect to a registry, a user must have at least Read Access to the Winreg subkey on the target computer. The Everyone group, which is given permissions by the default installation, typically has at least enough access allowed to browse. Therefore, the capability for an anonymous user to access the Registry over the network must be prevented.

Check Content

Wiindows XP/2003/Vista/2008 - Using the Registry Editor, navigate to the following Key: MACHINE/System/CurrentControlSet/Control/SecurePipeServers/Winreg If the key does not exist, then this is a finding. If the permissions are not at least as restrictive as those below, then this is a finding. Administrators all Backup Operators read(QENR) Local Service read (Exchange Enterprise Servers group on Domain Controllers and Exchange server all Documentable Explanation: On DCs and Exchange Servers, if permissions are sub-delegated with the Exchange Management console, then additional accounts and groups may appear on the Winreg key. If this has been done then these should be documented with the site IAO and made available for any reviewer.

Fix Text

Configure the system to prevent anonymous users from gaining access to the Registry.

Additional Identifiers

Rule ID: SV-13492r1_rule

Vulnerability ID: V-1152

Group Title: Anonymous Access to the Registry

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.