last updated at 23 Jul, 2004 15:59 (2 times)
Does anybody has any tips or know how to fix this vulnerability ?I will need to fix it, but I don't have skills on os/2 plataform.
Thanks for any help !!
=========================
Bellow more informations about the problem i'm facing.
The machine is running the HTTP Web Server IBM Internet Connection Server 4.2.1.3.
Thanks all !
=========================
Cross-Site-Tracing Vulnerability on Web Servers
CVE #:
N/A
Summary:
Web servers that enable TRACE or TRACK methods may allow CST/XST (Cross-site Tracing), which allows attackers to trick visiting web clients into executing malicious code.
Info:
Cross-site Tracing is a new variety of Cross-site scripting that uses the TRACE command of the HTTP/1.1 protocol. TRACE is basically a GET request that echoes the request back to the client running the command. It is possible to script some browsers to send the TRACE requests and return echoed headers to the script. The headers can carry cookies or authorization strings to the server, and can potentially be retrieved by attackers.
Cross Site Scripting Explanation:
A Hacker constructs malicious code that includes scripts enclosed in unparsed tags that will execute on the web client of visitors. By accepting tags in user input, server may allow scripts embedded in the input to run in the authorization context of the server on the client. The server does not execute the script; it accepts the script from a hacker and serves the script to a visiting client. Then the client's browser executes the script embedded in the HTML from the server.
Embedded scripts may also change the action of form tags, changing what programs the form runs and where it sends
information. The malicious request may be typed in directly or left in innocent seeming links that anyone may follow,
hiding the source of the request from logging.
Fix:
This vulnerability is theoretical, but apparently vulnerable on most servers. Contact vendor for more information on the vulnerability and how to disable the TRACE and TRACK methods. See references for thorough details.
Apache users can add the following lines to each virtual host in the config file:
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
IIS users can use the URLScan tool to deny HTTP TRACE and TRACK or permit only the methods needed for the site to run. URLScan is part of the Microsoft IIS Lockdown Tool.
How to Configure URLScan
Domino R5 users can add the following line to httpd.cnf:
disable TRACE
Domino R6 users can add the following to notes.ini if the web server is using web configuration view:
HTTPDisableMethods=TRACE
If the web server is using the Internet Sites view for configuration, customers must edit each web site document and uncheck the TRACE method so that the method is disallowed.
References:
CERT
CERT Vulnerability Note VU#867593
NSA Ref Handle
http-css-trace-1
NSA Ref Key
NSA.HTTPCSS.trace-1
NSA Switch
nsa-vuln.http.css.trace
Nessus
11213
OAR
MSS-OAR-E01-2003:0189.1
MSS-OAR-E01-2003:0685.1
MSS-OAR-E01-2003:1123.1
MSS-OAR-E01-2004:0109.1
Other
White Hat Security Press Release
Neohapsis Cross-Site Tracing Message
LWN.net Cross-site tracing attacks
Help Net Security Cross-Site Tracing (XST)
White Hat Security Cross-site Tracing Whitepaper