Can my server perform Cross-Site-Tracing/Scripting Attack?

This is a discussion on Can my server perform Cross-Site-Tracing/Scripting Attack? within the Linux Web Servers forums, part of the Web Server and Related Forums category; Folks, I've run a nessus check on my server and for the most part, I've got things pretty ...


Go Back   Usenet Forums > Web Server and Related Forums > Linux Web Servers

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 12-29-2003
Randell D.
 
Posts: n/a
Default Can my server perform Cross-Site-Tracing/Scripting Attack?


Folks,
I've run a nessus check on my server and for the most part, I've got things
pretty tight... I got one alert that, when I implemented the recommended
solution, it broke my Apache 1.3.29 installation (ie It would not restart -
all messages noted below). I think its because I have not compiled in
ReWrite... However, because I don't fully understand the reported alert, I
don't know if the alert is a false positive, or something I should really
fix.

The Nessus Alert is immediately below, followed by the Apache error message
I get when I attempt to re-start it...


*NESSUS ALERT MESSAGE*
Your webserver supports the TRACE and/or TRACK methods. TRACE and TRACK
are HTTP methods which are used to debug web server connections.

It has been shown that servers supporting this method are subject
to cross-site-scripting attacks, dubbed XST for
"Cross-Site-Tracing", when used in conjunction with
various weaknesses in browsers.

An attacker may use this flaw to trick your
legitimate web users to give him their
credentials.

Solution: Disable these methods.


If you are using Apache, add the following lines for each virtual
host in your configuration file :

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

See http://www.whitehatsec.com/press_rel...R-20030120.pdf
http://archives.neohapsis.com/archiv...3-q1/0035.html
http://sunsolve.sun.com/pub-cgi/retr...salert%2F50603
http://www.kb.cert.org/vuls/id/867593

Risk factor : Medium

*APACHE MESSAGE I GET AFTER RESTART*
Invalid command 'RewriteEngine', perhaps mis-spelled or defined by a module
not included in the server configuration


So my question... Should I really worry about the above alert message, or
should I ignore it as a false positive?

All help, via the ng, is much appreciated,
Thanks
Randell D.


 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 07:44 AM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0