WG460 IIS6 - PERL scripts must use the TAINT option.

Information

PERL (Practical Extraction and Report Language) is an interpreted language optimized for scanning arbitrary text files, extracting information from those text files, and printing reports based on that information. The language is often used in shell scripting and is intended to be practical, easy to use, and efficient means of generating interactive web pages for the user. Unfortunately, many widely available freeware PERL programs (scripts) are extremely insecure. This is most readily accomplished by a malicious user substituting input to a PERL script during a POST or a GET operation.

Consequently, the founders of PERL have developed a mechanism named TAINT that protects the system from malicious input sent from outside the program. When the data is tainted, it cannot be used in programs or functions such as eval(), system(), exec(), pipes, or popen(). The script will exit with a warning message.

Solution

Adjust the PERL scripts to include the appropriate comments enabling the TAINT option.

See Also

http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-10, CAT|II, Rule-ID|SV-38114r1_rule, STIG-ID|WG460_IIS6, Vuln-ID|V-2272

Plugin: Windows

Control ID: 66593cee9cad18d7a8a4fdc0affc590343b042e418c0ee1d5821394b023668be