<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" id="MS_Dot_Net_Framework" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://www.w3.org/2000/09/xmldsig# http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd" style="SCAP_1.1">
  <status date="2016-03-11">accepted</status>
  <title>Microsoft Dot Net Framework 4.0 STIG</title>
  <description>Applicable to systems and applications utilizing the Microsoft .Net version 4.0 framework.</description>
  <notice id="terms-of-use" xml:lang="en" />
  <reference href="http://iase.disa.mil">
    <dc:publisher>DISA</dc:publisher>
    <dc:source>STIG.DOD.MIL</dc:source>
  </reference>
  <plain-text id="release-info">Release: 4 Benchmark Date: 22 Apr 2016</plain-text>
  <platform idref="cpe:/a:microsoft:.net_framework:4.0" />
  <version>1</version>
  <metadata>
    <dc:creator>DISA</dc:creator>
    <dc:publisher>DISA</dc:publisher>
    <dc:contributor>DISA</dc:contributor>
    <dc:source>STIG.DOD.MIL</dc:source>
  </metadata>
  <Profile id="MAC-1_Classified">
    <title>I - Mission Critical Classified</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-1_Public">
    <title>I - Mission Critical Public</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-1_Sensitive">
    <title>I - Mission Critical Sensitive</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-2_Classified">
    <title>II - Mission Support Classified</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-2_Public">
    <title>II - Mission Support Public</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-2_Sensitive">
    <title>II - Mission Support Sensitive</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-3_Classified">
    <title>III - Administrative Classified</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-3_Public">
    <title>III - Administrative Public</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="MAC-3_Sensitive">
    <title>III - Administrative Sensitive</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-7055" selected="true" />
    <select idref="V-7061" selected="true" />
    <select idref="V-30926" selected="true" />
    <select idref="V-31026" selected="true" />
  </Profile>
  <Profile id="CAT_I_Only">
    <title>CAT I Only</title>
    <description>This profile only includes rules that are Severity Category I.</description>
    <select idref="SV-40966r1_rule" selected="false" />
    <select idref="SV-41075r1_rule" selected="false" />
    <select idref="SV-7438r2_rule" selected="false" />
    <select idref="SV-7444r3_rule" selected="false" />
  </Profile>
  <Group id="V-7055">
    <title>APPNET0031 No Strong Name Verification</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-7438r2_rule" severity="medium" weight="10.0">
      <version>APPNET0031</version>
      <title>Digital signatures assigned to strongly named assemblies must be verified.</title>
      <description>&lt;VulnDiscussion&gt;A strong name consists of the assembly's identity, simple text name, version number, and culture information (if provided)—plus a public key and a digital signature.  Strong names serve to identify the author of the code.  If digital signatures used to sign strong name assemblies are not verified, any self signed code can be impersonated.  This can lead to a loss of system integrity. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCSL-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target Framework 4.0</dc:title>
        <dc:publisher>DISA</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>Framework 4.0</dc:subject>
        <dc:identifier>2030</dc:identifier>
      </reference>
      <fixtext fixref="F-12596r7_fix">Use regedit to remove the values stored in Windows registry key HKLM\Software\Microsoft\StrongName\Verification. There should be no assemblies or hash values listed under this registry key.

All assemblies must require strong name verification in a production environment.

Strong name assemblies that do not require verification in a development or test environment must have documented approvals from the IAO.</fixtext>
      <fix id="F-12596r7_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.dotnet:def:2" href="stig-dotnet4-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-7061">
    <title>APPNET0046 Test Root certificates</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-7444r3_rule" severity="medium" weight="10.0">
      <version>APPNET0046</version>
      <title>The Trust Providers Software Publishing State must be set to 0x23C00.</title>
      <description>&lt;VulnDiscussion&gt;Microsoft Windows operating systems provide a feature called Authenticode.  Authenticode technology and its underlying code signing mechanisms serve to provide a structure to identify software publishers and ensure that software applications have not been tampered with.  Authenticode technology relies on digital certificates and is based on Public Key Cryptography Standards (PKCS) #7 (encrypted key specification), PKCS #10 (certificate request formats), X.509 (certificate specification), and Secure Hash Algorithm (SHA) and MD5 hash algorithms.

The manner in which the Authenticode technology validates a certificate and determines what is considered a valid certificate can be modified to meet the mission of the Microsoft Windows system.  Each facade of certificate validation is controlled through the bits that makeup the hexadecimal value for the Authenticode setting.  An improper setting will allow non-valid certificates to be accepted and can put the integrity of the system into jeopardy.

The hexadecimal value of 0x23C00 will implement the following certificate enforcement policy:
- Trust the Test Root = FALSE
- Use expiration date on certificates = TRUE
- Check the revocation list = TRUE
- Offline revocation server OK (Individual) = TRUE
- Offline revocation server OK (Commercial) = TRUE
- Java offline revocation server OK (Individual) = TRUE
- Java offline revocation server OK (Commercial) = TRUE
- Invalidate version 1 signed objects = FALSE
- Check the revocation list on Time Stamp Signer = FALSE
- Only trust items found in the Trust DB = FALSE
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target Framework 4.0</dc:title>
        <dc:publisher>DISA</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>Framework 4.0</dc:subject>
        <dc:identifier>2030</dc:identifier>
      </reference>
      <fixtext fixref="F-12602r12_fix">This fix must be performed for each user on the system.

Using regedit, change the hexadecimal value of the "HKEY_USER\[UNIQUE USER SID VALUE]\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State" registry key to 0x23C00.</fixtext>
      <fix id="F-12602r12_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.dotnet:def:15" href="stig-dotnet4-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-30926">
    <title>APPNET0062 Administering FIPS Policy</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-40966r1_rule" severity="medium" weight="10.0">
      <version>APPNET0062</version>
      <title>The .NET CLR must be configured to use FIPS approved encryption modules.</title>
      <description>&lt;VulnDiscussion&gt;FIPS encryption is configured via .NET configuration files.  There are numerous configuration files that affect different aspects of .Net behavior.  The .NET config files are described below.
 
Machine Configuration Files:
The machine configuration file, Machine.config, contains settings that apply to an entire computer. This file is located in the %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config directory for 32 bit .NET 4 installations and %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config for 64 bit systems.   Machine.config contains configuration settings for machine-wide assembly binding, built-in remoting channels, and ASP.NET.

Application Configuration Files:
Application configuration files contain settings specific to an application. If checking these files, a .NET review of a specific .NET application is most likely being conducted. These files contain configuration settings that the Common Language Runtime reads (such as assembly binding policy, remoting objects, and so on), and settings that the application can read. 

The name and location of the application configuration file depends on the application's host, which can be one of the following: 

Executable–hosted application configuration files. 

The configuration file for an application hosted by the executable host is in the same directory as the application. The name of the configuration file is the name of the application with a .config extension. For example, an application called myApp.exe can be associated with a configuration file called myApp.exe.config. 

Internet Explorer-hosted application configuration files. 

If an application hosted in Internet Explorer has a configuration file, the location of this file is specified in a &lt;link&gt; tag with the following syntax.

&lt;link rel="ConfigurationFileName" href="location"&gt;

In this tag, "location" represents a URL that point to the configuration file. This sets the application base. The configuration file must be located on the same web site as the application. 

.NET 4.0 allows the CLR runtime to be configured to ignore FIPS encryption requirements.  If the CLR is not configured to use FIPS encryption modules, insecure encryption modules might be employed which could introduce an application confidentiality or integrity issue.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Web Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCNR-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target Framework 4.0</dc:title>
        <dc:publisher>DISA</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>Framework 4.0</dc:subject>
        <dc:identifier>2030</dc:identifier>
      </reference>
      <fixtext fixref="F-34734r4_fix">Examine the .NET CLR configuration files to find the runtime element and then the "enforceFIPSPolicy" element.

Example:
&lt;configuration&gt; 
  &lt;runtime&gt; 
                &lt;enforceFIPSPolicy enabled="true|false" /&gt;
  &lt;/runtime&gt;
&lt;/configuration&gt;

Delete the "enforceFIPSPolicy" runtime element, change the setting to "true" or there must be documented IAO approvals for the FIPS setting.</fixtext>
      <fix id="F-34734r4_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.dotnet:def:9" href="stig-dotnet4-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-31026">
    <title>APPNET0067 .NET Event Tracing for Windows.</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-41075r1_rule" severity="medium" weight="10.0">
      <version>APPNET0067</version>
      <title>Event tracing for Windows (ETW) for Common Language Runtime events must be enabled.</title>
      <description>&lt;VulnDiscussion&gt;Event tracing captures information about applications utilizing the .NET CLR and the .NET CLR itself. This includes security oriented information, such as Strong Name and Authenticode verification.  

Beginning with Windows Vista, ETW is enabled by default however, the .Net CLR and .Net applications can be configured to not utilize Event Tracing. If ETW event tracing is disabled, critical events that occurred within the runtime will not be captured in event logs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;DCSL-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target Framework 4.0</dc:title>
        <dc:publisher>DISA</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>Framework 4.0</dc:subject>
        <dc:identifier>2030</dc:identifier>
      </reference>
      <fixtext fixref="F-34847r6_fix">Open Windows explorer and search for all .NET config files including application config files (*.exe.config).

Examine the configuration settings for 
&lt;etwEnable enabled="false" /&gt;.

Enable ETW Tracing by setting the etwEnable flag to "true" or obtain documented IAO approvals.</fixtext>
      <fix id="F-34847r6_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.dotnet:def:12" href="stig-dotnet4-oval.xml" />
      </check>
    </Rule>
  </Group>
</Benchmark>

