Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

IIS 7.0 Site STIG

The IIS 7.0 Site STIG (V1 R19) has 49 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

49STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R19

CurrentPublished Fri Jan 24 2020

The web-site must limit the number of bytes accepted in a request.

IIS 7.0 Site STIG

Assessment Title

Rule Text

Description

Discussion Text

By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-26041

Rule

SV-32692r3_rule

Severity

medium

Rule Version

WA000-WI6210

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

For each site reviewed: 
1. Open the IIS Manager.
2. Click on the site name.
3. Double-click the Request Filtering icon.
4. Click Edit Feature Settings in the Actions Pane.

If the maxAllowedContentLength value is not set to 30000000, this is a finding.

NOTE: If the site has operational reasons to set maxAllowedContentLength to an alternate value, and has supporting documentation signed by the ISSO, this is not a finding.

Implementation Procedure

Fix Text

1. Open the IIS Manager.
2. Click the site name under review.
3. Double-click the Request Filtering icon.
4. Click Edit Feature Settings in the Actions Pane.
5. Set the maxAllowedContentLength value to 30000000.

STIG check 37 of 49 in the IIS 7.0 Site STIG checklist

← Previous · V-26034The production web-site must configure the Global .NET Trust Level.Next · V-26042 →The production web-site must limit the MaxURL.