{"description": "Install anti-virus software on the system and set it to automatically scan new\nfiles that are introduced to the web server.", "rationale": "Remote web authors should not be able to upload files to the Document Root\ndirectory structure without virus checking and checking for malicious or mobile\ncode. A remote web user, whose agency has a Memorandum of Agreement (MOA) with\nthe hosting agency and has submitted a DoD form 2875 (System Authorization\nAccess Request (SAAR)) or an equivalent document, will be allowed to post files\nto a temporary location on the server. All posted files to this temporary\nlocation will be scanned for viruses and content checked for malicious or mobile\ncode. Only files free of viruses and malicious or mobile code will be posted to\nthe appropriate DocumentRoot directory.", "severity": "medium", "references": {}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "it is not", "ocil": "Remote web authors should not be able to upload files to the Document Root\ndirectory structure without virus checking and checking for malicious or mobile\ncode.", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": [], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Scan All Uploaded Content for Malicious Software", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_antivirus_scan_uploads/rule.yml", "template": null}