Synopsis : Debugging functions are enabled on the remote web server. Description : The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. In addition, it has been shown that servers supporting the TRACE method are subject to cross-site scripting attacks, dubbed XST for “Cross-Site Tracing”, when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. See also : http://www.cgisecurity.com/whitehat-mirr or/WH-WhitePaper_XST_ebook.pdf http://www.apacheweek.com/issues/03-01-2 4 http://www.kb.cert.org/vuls/id/288308 http://www.kb.cert.org/vuls/id/867593 Solution: Disable these methods. Risk Factor: Medium / CVSS Base Score : 5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N) Solution: Add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* – [F] Alternatively, note that Apache versions 1.3.34, 2.0.55, and 2.2 support disabling the TRACE method natively via the ‘TraceEnable’ directive. Plugin output : SMetrics sent the following TRACE request : —————————— snip —————————— TRACE /SMetrics1126665622.html HTTP/1.1 Connection: Close Host: www.ooohlalabath.com Pragma: no-cache User-Agent: Mozilla/4.75 [en] (X11, U Smetrics ) Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */* Accept-Language: en Accept-Charset: iso-8859-1,*,utf-8 —————————— snip —————————— and received the following response from the remote server : —————————— snip —————————— HTTP/1.1 200 OK Date: Mon, 20 Jul 2009 20:00:13 GMT Server: Apache/2.0.52 (CentOS) Connection: close Transfer-Encoding: chunked Content-Type: message/http TRACE /SMetrics1126665622.html HTTP/1.1 Connection: Close Host: www.ooohlalabath.com Pragma: no-cache User-Agent: Mozilla/4.75 [en] (X11, U Smetrics ) Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */* Accept-Language: en Accept-Charset: iso-8859-1,*,utf-8 —————————— snip —————————— CVE : CVE-2003-1567, CVE-2004-2320 BID : 9506, 9561, 11604, 33374 Other references : OSVDB:877, OSVDB:3726, OSVDB:5648 [More]
[Hide]