| VID |
27069 |
| Severity |
10 |
| Port |
135 |
| Protocol |
TCP |
| Class |
WMI |
| Detailed Description |
By granting * ACL to web data files, you can set execution and read restrictions from unauthorized users. If IIS is installed and operated in the future, it is recommended to grant ACL on web data file. When setting ACL, refer to the following.
1. It's a good idea to categorize the different types of files and save them in a folder.
2. Grant appropriate ACL permissions in your home directory (default: c: \ inetpub \ wwwroot).
* ACL (Access Control List): A list of the subjects and types of access granted.
* Platforms Affected:
Microsoft IIS Server |
| Recommendation |
¡á IIS 5.0, 6.0
1. Start> Run> INETMGR> Website> Select website> Properties> Home Directory
2. Explorer> Home Directory> Properties> Security Tab> Check Security
3. Remove unnecessary Everyone rights of below files (Everyone(X), Administrator/System)
- CGI(.exe, .dll, .cmd, .pl)
- Script file(.aspl)
- Include file(.inc, .shtm, .shtml)
- Static Contents(.txt, .gif, jpg. .html)
¡á IIS 7.0, 8.0, 10.0
1. Start> Run> INETMGR> Website> Select website> default> Check real path
2. Explorer> Home Directory> Properties> Security Tab> Check Security
3. Remove unnecessary Everyone rights of below files (Everyone(X), Administrator/System)
- CGI(.exe, .dll, .cmd, .pl)
- Script file(.aspl) |
| Related URL |
(CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
