Web server software must be a vendor-supported version.

From APACHE 2.2 Server for UNIX Security Technical Implementation Guide

Part of WG190

SV-36441r2_rule Web server software must be a vendor-supported version.

Vulnerability discussion

Many vulnerabilities are associated with older versions of web server software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining the web server at a current version makes the efforts of a malicious user to exploit the web service more difficult.

Check content

To determine the version of the Apache software that is running on the system. Use the command: httpd –v httpd2 –v If the version of Apache is not at the following version or higher, this is a finding. Apache httpd server version 2.2 - Release 2.2.31 (July 2015) Note: In some situations, the Apache software that is being used is supported by another vendor, such as Oracle in the case of the Oracle Application Server or IBMs HTTP Server. The versions of the software in these cases may not match the above mentioned version numbers. If the site can provide vendor documentation showing the version of the web server is supported, this would not be a finding.

Fix text

Install the current version of the web server software and maintain appropriate service packs and patches.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.