WA000-WI6088 IIS6 - The MaxRequestBytes registry entry must be set properly.

Information

Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The MaxRequestBytes registry key determines the upper limit for the total size of the HTTP request line and headers. If this value is set too high, performance or Denial of Service conditions may appear.

Solution

1. Open the registry editor.
2. Navigate to the following location in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters.
3. Set the value for the MaxRequestBytes key to REG_DWORD 16384 (or less) or add the key and set it to REG_DWORD 16384.

See Also

http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CAT|II, Rule-ID|SV-38164r2_rule, STIG-ID|WA000-WI6088_IIS6, Vuln-ID|V-13718

Plugin: Windows

Control ID: 21b5332d5a2fac2490abbce4a017e2a3fb2c43529254a47b3aa0fa7d354a3792