Information
Vulnerability Key: V0002268
IA Controls: ECSC-1 Security Configuration Compliance
Categories: 2.2 Least Privilege
Severity: Category II
Ref: WEB SERVER SECURITY TECHNICAL IMPLEMENTATION GUIDE Section 2.1, Guide to the Secure Configuration and Administration
of Microsoft Internet Information
Owing to the nature of .inc files, which may contain sensitive logic and potentially reveal sensitive
information about the architecture of the web server, it is vital that the end user not be able to access
and examine code that is included in .inc files. When server side scripting is the preferred method, this
is normally not a problem. Nonetheless, there are key files inherent to the process, which can contain
information key to the logic, server structure and configuration of the entire application. .inc files are the
include files for many .asp script files. If the correct file name is guessed or derived, their contents will
be displayed by a browser. The file must be guarded from prying eyes of the anonymous web user. If
the site has named thier include files with the .asp extension, then the files will be processed as
an .asp file, which by the nature of .asp, will prevent that code from being presented. If the files are
named with the .inc extension, or equivilent, you do not have this advantage. Java Server Pages, jsp,
is another example of a competing technology which the reviewer will also encounter, that are
impacted by this issue. The sample principles outlined here will apply to inlcude files used with Java
Server Pages. In addition, there are some additional files that need to be protected, which include the
global.asa and global.asax files.
NOTE: This check only searches the 'C:' drive, if the system has multiple drives ensure each drive doesn't contain compilers.
NOTE: If there is nothing reported in the plugin output then Nessus did not find any files named global.asa.
NOTE: If the global.asa was found, review the permissions to ensure IUSR_machinename does not have read access and these extensions
are mapped to the asp.dll.