The use of Internet Printing Protocol (IPP) must be disabled on the IIS web server.

SV-32222r2_rule The use of Internet Printing Protocol (IPP) must be disabled on the IIS web server.

Vulnerability discussion

The use of Internet Printing Protocol (IPP) on an IIS web server allows client’s access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.

Check content

If the Print Services role and the Internet Printing role are not installed, this check is N/A. Navigate to the following directory: %windir%\web\printers If this folder exists, this is a finding. Determine whether Internet Printing is enabled: 1. Click Start, then click Administrative Tools, and then click Server Manager. 2. Expand the roles node, then right-click Print Services, and then select Remove Roles Services. 3. If the Internet Printing option is enabled, this is a finding.

Fix text

1. Click Start, then click Administrative Tools, and then click Server Manager. 2. Expand the roles node, then right-click Print Services, and then select Remove Roles Services. 3. If the Internet Printing option is checked, clear the check box, click Next, and then click Remove to complete the wizard.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.