RSS feed synchronization with Common Feed List must be disallowed.

From Microsoft Outlook 2010

Part of DTOO281 - Sync RSS Feeds w/Common List

SV-33501r1_rule RSS feed synchronization with Common Feed List must be disallowed.

Vulnerability discussion

The Common Feed list is a hierarchical set of RSS feeds to which clients such as Outlook 2010, the Feeds list in Internet Explorer, and the Feed Headlines Sidebar gadget in Windows Vista can subscribe.If Outlook subscribes to a very large feed list, performance and availability can be affected, especially if Outlook is configured to download full RSS message bodies or if the feed list is not AutoArchived regularly. By default, Outlook maintains its own list of feeds and does not automatically subscribe to RSS feeds that are added to the Common Feed List.

Check content

The policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Account Settings -> RSS Feeds “Synchronize Outlook RSS Feeds with Common Feed List” must be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\14.0\outlook\options\rss Criteria: If the value SyncToSysCFL is REG_DWORD = 0, this is not a finding.

Fix text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Account Settings -> RSS Feeds “Synchronize Outlook RSS Feeds with Common Feed List” to “Disabled”.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.