This is a discussion on Can my server perform Cross-Site-Tracing/Scripting Attack? within the Linux Web Servers forums, part of the Web Server and Related Forums category; Folks, I've run a nessus check on my server and for the most part, I've got things pretty ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
Folks, I've run a nessus check on my server and for the most part, I've got things pretty tight... I got one alert that, when I implemented the recommended solution, it broke my Apache 1.3.29 installation (ie It would not restart - all messages noted below). I think its because I have not compiled in ReWrite... However, because I don't fully understand the reported alert, I don't know if the alert is a false positive, or something I should really fix. The Nessus Alert is immediately below, followed by the Apache error message I get when I attempt to re-start it... *NESSUS ALERT MESSAGE* Your webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. If you are using Apache, add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] See http://www.whitehatsec.com/press_rel...R-20030120.pdf http://archives.neohapsis.com/archiv...3-q1/0035.html http://sunsolve.sun.com/pub-cgi/retr...salert%2F50603 http://www.kb.cert.org/vuls/id/867593 Risk factor : Medium *APACHE MESSAGE I GET AFTER RESTART* Invalid command 'RewriteEngine', perhaps mis-spelled or defined by a module not included in the server configuration So my question... Should I really worry about the above alert message, or should I ignore it as a false positive? All help, via the ng, is much appreciated, Thanks Randell D. |