Details

To identify the type of web servers and versions software installed it is common for attackers to scan for icons or special content specific to the server type and version. A simple request like http://example.com/icons/apache_pb2.png may tell the attacker that the server is Apache 2.2 as shown below. The many icons are used primary for auto indexing, which is recommended to be disabled.

Solution

Disable the autoindex_module by adding a ‘#’ in front of it within the httpd.conf file, and restarting the Apache httpd service.

Supportive Information

The following resource is also helpful.

• https://iasecontent.disa.mil/stigs/zip/U_Apache_2-2_WIN_V1R13_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-7a.
• CAT|II
• Rule-ID|SV-33225r1_rule
• STIG-ID|WA00515_W22
• Vuln-ID|V-26368

Source

• Tenable.com/audits