Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] Apache TRACE HTTP method disabling

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: "Matt Pusateri" <mpusateri AT wickedtrails.com>
  • To: "Internetworkers: http://www.ibiblio.org/internetworkers/" <internetworkers AT lists.ibiblio.org>
  • Subject: Re: [internetworkers] Apache TRACE HTTP method disabling
  • Date: Wed, 30 Mar 2005 13:47:28 -0500 (EST)

On Wed, March 30, 2005 1:11 pm, jeremy snyder said:
> hi,
>
> my company is getting a security audit by a very large prospective
> customer.
> the customer ran a vulnerability scan on our production network, and
> found a
> "TRACE HTTP method enabled" vulnerability.
>
> we've googled like crazy trying to find a solution. we've found this
> comment
>
> You can see
> http://mail-archives.eu.apache.org/mod_mbox/httpd-users/200306.mbox/%3CC478F274880F434EA3A666FE16F7BCAB0200B67A AT ACCLUST04EVS1.ugd.att.com%3E
>
> And the follow-up response at
>
> http://mail-archives.eu.apache.org/mod_mbox/httpd-users/200306.mbox/%3cPine.WNT.4.55.0306051514550.288 AT Poste3947.hec.ca%3e
>
> With a recommended fix at
>
> http://www.apacheweek.com/issues/03-01-24#news
>
> We've tried this, but to no avail. The vulnerability still shows.
>
> anyone have any idea on this? we're on apache 1.3.33 on debian linux.
>
> Thanks,
> Jeremy

Does it show when you run Nikto or Nessus? If not maybe you can
convince them that your own security audits show it's not a problem.







Archive powered by MHonArc 2.6.24.

Top of Page