OS2 World.Com Forum

Subject  :  I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  leandro leandroroliveira@yahoo.com.br
Date  :  16 Jul, 2004 on 15:05
Does anybody has any tips or know how to fix this vulnerability ?

I will need to fix it, but I don't have skills on os/2 plataform.

Thanks for any help !!

=========================
Bellow more informations about the problem i'm facing.

The machine is running the HTTP Web Server IBM Internet Connection Server 4.2.1.3.

Thanks all !
=========================

Cross-Site-Tracing Vulnerability on Web Servers
CVE #:
N/A

Summary:
Web servers that enable TRACE or TRACK methods may allow CST/XST (Cross-site Tracing), which allows attackers to trick visiting web clients into executing malicious code.

Info:
Cross-site Tracing is a new variety of Cross-site scripting that uses the TRACE command of the HTTP/1.1 protocol. TRACE is basically a GET request that echoes the request back to the client running the command. It is possible to script some browsers to send the TRACE requests and return echoed headers to the script. The headers can carry cookies or authorization strings to the server, and can potentially be retrieved by attackers.

Cross Site Scripting Explanation:
A Hacker constructs malicious code that includes scripts enclosed in unparsed tags that will execute on the web client of visitors. By accepting tags in user input, server may allow scripts embedded in the input to run in the authorization context of the server on the client. The server does not execute the script; it accepts the script from a hacker and serves the script to a visiting client. Then the client's browser executes the script embedded in the HTML from the server.

Embedded scripts may also change the action of form tags, changing what programs the form runs and where it sends
information. The malicious request may be typed in directly or left in innocent seeming links that anyone may follow,
hiding the source of the request from logging.

Fix:
This vulnerability is theoretical, but apparently vulnerable on most servers. Contact vendor for more information on the vulnerability and how to disable the TRACE and TRACK methods. See references for thorough details.
Apache users can add the following lines to each virtual host in the config file:
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

IIS users can use the URLScan tool to deny HTTP TRACE and TRACK or permit only the methods needed for the site to run. URLScan is part of the Microsoft IIS Lockdown Tool.
How to Configure URLScan

Domino R5 users can add the following line to httpd.cnf:
disable TRACE

Domino R6 users can add the following to notes.ini if the web server is using web configuration view:
HTTPDisableMethods=TRACE
If the web server is using the Internet Sites view for configuration, customers must edit each web site document and uncheck the TRACE method so that the method is disallowed.

References:
CERT
CERT Vulnerability Note VU#867593

NSA Ref Handle
http-css-trace-1

NSA Ref Key
NSA.HTTPCSS.trace-1

NSA Switch
nsa-vuln.http.css.trace

Nessus
11213

OAR
MSS-OAR-E01-2003:0189.1
MSS-OAR-E01-2003:0685.1
MSS-OAR-E01-2003:1123.1
MSS-OAR-E01-2004:0109.1

Other
White Hat Security Press Release
Neohapsis Cross-Site Tracing Message
LWN.net Cross-site tracing attacks
Help Net Security Cross-Site Tracing (XST)
White Hat Security Cross-site Tracing Whitepaper


Subject  :  Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  paco paco@os2world.com
Date  :  16 Jul, 2004 on 22:39
Please explain the vulnerability and what exactly affects .

Email me on fsignes@ctv.es if necesary


Subject  :  Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  Kim
Date  :  16 Jul, 2004 on 23:08
Please provide me with the SA number from Secunia.com.

/Kim


Subject  :  Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  leandro leandroroliveira@yahoo.com.br
Date  :  23 Jul, 2004 on 16:00
Hi,

I put the informations on the topic, pls take a look at it.
Tks !



paco (16 Jul, 2004 22:39):
Please explain the vulnerability and what exactly affects .

Email me on fsignes@ctv.es if necesary



Subject  :  Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  Kim
Date  :  27 Jul, 2004 on 18:33
leandro,

when checking in on above topic and the content of the advisory you posted I couldn't find any thing regarding this vulnerability. So a bit hard to advice you if there is no general advisory posted, ie that is why I asked for any kind of SA or CVE record number. In general cross-site vulnerabilities has a very low severity. Also as far as I can figure out it seems that no vendor has posted any kind of advisories regarding this topic.

Curious, but what have you done to other OS using IBM http server? Good news is that rather often the vulnerability tend to exploitable on unix system and is harder to exploit on OS2 system. But, once again I'm curious what you have done to fix this issue on other OS.


Subject  :  Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  leandro leandroroliveira@yahoo.com.br
Date  :  27 Jul, 2004 on 21:24
Hi, Kim.

I really don't have a SA or CVE record number.

We just use IBM http server on the os/2 systems.
The others are using Domino, IIS or Apache.

Thanks a lot for your attention.


Kim (27 Jul, 2004 18:33):
leandro,

when checking in on above topic and the content of the advisory you posted I couldn't find any thing regarding this vulnerability. So a bit hard to advice you if there is no general advisory posted, ie that is why I asked for any kind of SA or CVE record number. In general cross-site vulnerabilities has a very low severity. Also as far as I can figure out it seems that no vendor has posted any kind of advisories regarding this topic.

Curious, but what have you done to other OS using IBM http server? Good news is that rather often the vulnerability tend to exploitable on unix system and is harder to exploit on OS2 system. But, once again I'm curious what you have done to fix this issue on other OS.



Subject  :  Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  leandro leandroroliveira@yahoo.com.br
Date  :  27 Jul, 2004 on 21:28

leandro (27 Jul, 2004 21:24):
Hi, Kim.

I really don't have a SA or CVE record number.

We just use IBM http server on the os/2 systems.
The others are using Domino, IIS or Apache.

Also, I will try to disable TRace/Track methods on the Web Server, I still don't know where I can configure that, but this should correct the potential vulnerability.

Thanks a lot for your attention.


Kim (27 Jul, 2004 18:33):
leandro,

when checking in on above topic and the content of the advisory you posted I couldn't find any thing regarding this vulnerability. So a bit hard to advice you if there is no general advisory posted, ie that is why I asked for any kind of SA or CVE record number. In general cross-site vulnerabilities has a very low severity. Also as far as I can figure out it seems that no vendor has posted any kind of advisories regarding this topic.

Curious, but what have you done to other OS using IBM http server? Good news is that rather often the vulnerability tend to exploitable on unix system and is harder to exploit on OS2 system. But, once again I'm curious what you have done to fix this issue on other OS.




Subject  :  Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1].
Author  :  Kim
Date  :  27 Jul, 2004 on 22:16
To get some more info about posted advisories for IBM related products, check following url:

http://secunia.com/vendor/62/

and click on the product that you have the interest in; you will then get statistics on severity level, what kind of exploits, etc that have been posted in the past.

Have fun.


Powered by UltraBoard 2000 <www.ub2k.com>