Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Execution Restricted File Type Properties
Description
Discussion Text
For certain file types, it is necessary to take steps to ensure that the default method of opening the file does not allow mobile code to be executed. Two techniques to achieve this goal are discussed here—altering the default file type Action and deleting the file type definition. Although methods of removing Microsoft’s Windows Script Host (WSH) component might meet most of this requirement, that technique should not be the first choice. It would disable functionality that might be in use for other purposes, and the specific method used would have to be compatible with the Windows File Protection (WFP) feature present in later versions of Windows.
The default Action property can be altered to change the standard default Action from Open to Edit. When this technique is used, instead of executing a program with the file contents as code, an editor is opened with the file contents as a document. For example for a .vbs file, the Open action may be the command ’C:\WINNT\System32\Wscript.exe "%1" %*’ and the Edit action may be the command ‘C:\WINNT\System32\Notepad.exe "%1" %*’. Changing the default action to Edit results in a Notepad window opening up instead of the file being executed by the Windows Scripting Host when the .vbs file is opened. For non-technical user communities, an alternative that may be more appropriate is to have the Edit action be the command ’C:\WINNT\System32\Notepad.exe "C:\MC_Warn.txt"’, where the file C:\MC_Warn.txt is created locally and contains a warning that the user has attempted to open a potentially dangerous file.
When altering the default file type Action is the technique used, the Always show extension setting adds additional value. This ensures that users can see the file type before attempting to open it.
While the alternate technique of deleting existing Windows file type definitions does provide security, it is not always a more secure long-term solution. During maintenance or product installation, a non-existent file type is usually defined while existing file type properties are usually not overwritten.
Regardless of which technique is used, the significant result is that when an attempt is made to open certain files using default application actions, any code in the file is not executed.
FIle extensions of certain files should not be hidden. Users can double click a file without knowing what type of file (or which application) is being opened.
The default Action property can be altered to change the standard default Action from Open to Edit. When this technique is used, instead of executing a program with the file contents as code, an editor is opened with the file contents as a document. For example for a .vbs file, the Open action may be the command ’C:\WINNT\System32\Wscript.exe "%1" %*’ and the Edit action may be the command ‘C:\WINNT\System32\Notepad.exe "%1" %*’. Changing the default action to Edit results in a Notepad window opening up instead of the file being executed by the Windows Scripting Host when the .vbs file is opened. For non-technical user communities, an alternative that may be more appropriate is to have the Edit action be the command ’C:\WINNT\System32\Notepad.exe "C:\MC_Warn.txt"’, where the file C:\MC_Warn.txt is created locally and contains a warning that the user has attempted to open a potentially dangerous file.
When altering the default file type Action is the technique used, the Always show extension setting adds additional value. This ensures that users can see the file type before attempting to open it.
While the alternate technique of deleting existing Windows file type definitions does provide security, it is not always a more secure long-term solution. During maintenance or product installation, a non-existent file type is usually defined while existing file type properties are usually not overwritten.
Regardless of which technique is used, the significant result is that when an attempt is made to open certain files using default application actions, any code in the file is not executed.
FIle extensions of certain files should not be hidden. Users can double click a file without knowing what type of file (or which application) is being opened.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.