Information
Vulnerability Key: V0002230
IA Controls: ECSC-1 Security Configuration Compliance
Categories: 2.2 Least Privilege
Severity: Category II
Ref: WEB SERVER SECURITY TECHNICAL IMPLEMENTATION GUIDE Section 4.2, Guide to the Secure Configuration and Administration
of Microsoft Internet Information
Copies of backup files will not execute on the server, but can be read by the anonymous user if special
precautions are not taken. Such backup copies contain the same sensitive information as the actual
script being executed and as such are useful to malicious users. Techniques and systems exist today
which search web servers for such files and are able to exploit the information contained in them.
Backup copies of files are automatically created by some text editors such as emacs and edit plus. The
emacs editor will write a backup file with an extension ~ added to the name of the original file; edit plus
will create a .bak file. Of course, this would imply the presence and use of development tools on the
web server, a finding under WG130. Having backup scripts on the web server provides one more
opportunity for malicious persons to view these scripts and use information found in them.
NOTE: This check only searches the 'C:' drive, if the system has multiple drives ensure each drive doesn't contain compilers.
NOTE: If there is nothing reported in the plugin output then Nessus did not find any backup files on the system.