| Subject | : | I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | leandro leandroroliveira@yahoo.com.br |
| Date | : | 16 Jul, 2004 on 15:05 |
| Does anybody has any tips or know how to fix this vulnerability ? I will need to fix it, but I don't have skills on os/2 plataform. Thanks for any help !! ========================= The machine is running the HTTP Web Server IBM Internet Connection Server 4.2.1.3. Thanks all ! Cross-Site-Tracing Vulnerability on Web Servers Summary: Info: Cross Site Scripting Explanation: Embedded scripts may also change the action of form tags, changing what programs the form runs and where it sends Fix: IIS users can use the URLScan tool to deny HTTP TRACE and TRACK or permit only the methods needed for the site to run. URLScan is part of the Microsoft IIS Lockdown Tool. Domino R5 users can add the following line to httpd.cnf: Domino R6 users can add the following to notes.ini if the web server is using web configuration view: References: NSA Ref Handle NSA Ref Key NSA Switch Nessus OAR Other |
| Subject | : | Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | paco paco@os2world.com |
| Date | : | 16 Jul, 2004 on 22:39 |
| Please explain the vulnerability and what exactly affects . Email me on fsignes@ctv.es if necesary |
| Subject | : | Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | Kim |
| Date | : | 16 Jul, 2004 on 23:08 |
| Please provide me with the SA number from Secunia.com. /Kim |
| Subject | : | Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | leandro leandroroliveira@yahoo.com.br |
| Date | : | 23 Jul, 2004 on 16:00 |
| Hi, I put the informations on the topic, pls take a look at it.
|
| Subject | : | Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | Kim |
| Date | : | 27 Jul, 2004 on 18:33 |
| leandro, when checking in on above topic and the content of the advisory you posted I couldn't find any thing regarding this vulnerability. So a bit hard to advice you if there is no general advisory posted, ie that is why I asked for any kind of SA or CVE record number. In general cross-site vulnerabilities has a very low severity. Also as far as I can figure out it seems that no vendor has posted any kind of advisories regarding this topic. Curious, but what have you done to other OS using IBM http server? Good news is that rather often the vulnerability tend to exploitable on unix system and is harder to exploit on OS2 system. But, once again I'm curious what you have done to fix this issue on other OS. |
| Subject | : | Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | leandro leandroroliveira@yahoo.com.br |
| Date | : | 27 Jul, 2004 on 21:24 |
| Hi, Kim. I really don't have a SA or CVE record number. We just use IBM http server on the os/2 systems. Thanks a lot for your attention.
|
| Subject | : | Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | leandro leandroroliveira@yahoo.com.br |
| Date | : | 27 Jul, 2004 on 21:28 |
|
| Subject | : | Re:I need a solution for the vulnerability: Server is an enabling vector for cross-site scripting exposure in clients [trace-1]. |
| Author | : | Kim |
| Date | : | 27 Jul, 2004 on 22:16 |
| To get some more info about posted advisories for IBM related products, check following url: and click on the product that you have the interest in; you will then get statistics on severity level, what kind of exploits, etc that have been posted in the past. Have fun. |