[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

249966

 
 

909

 
 

195636

 
 

282

Paid content will be excluded from the download.


Download | Alert*
OVAL

Backup interactive scripts on the production web server are prohibited.

ID: oval:org.secpod.oval:def:73539Date: (C)2021-06-29   (M)2023-07-04
Class: COMPLIANCEFamily: unix




Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today that search web servers for such files and are able to exploit the information contained in them. Backup copies of files are automatically created by some text editors such as emacs and edit plus. The emacs editor will write a backup file with an extension ~ added to the name of the original file. The edit plus editor will create a .bak file. Of course, this would imply the presence and use of development tools on the web server, which is a finding under WG130. Having backup scripts on the web server provides one more opportunity for malicious persons to view these scripts and use the information found in them.

Platform:
Linux
Product:
Apache HTTP Server 2.2
Reference:
CCE-94581-6
CCE    1
CCE-94581-6
XCCDF    1
xccdf_org.secpod_benchmark_stig_apache_2.2_server

© SecPod Technologies