Skip to Content.
Sympa Menu

internetworkers - [internetworkers] Apache TRACE HTTP method disabling

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: "jeremy snyder" <halffinn AT hotmail.com>
  • To: internetworkers AT lists.ibiblio.org
  • Subject: [internetworkers] Apache TRACE HTTP method disabling
  • Date: Wed, 30 Mar 2005 18:11:11 +0000

hi,

my company is getting a security audit by a very large prospective customer. the customer ran a vulnerability scan on our production network, and found a "TRACE HTTP method enabled" vulnerability.

we've googled like crazy trying to find a solution. we've found this comment

You can see http://mail-archives.eu.apache.org/mod_mbox/httpd-users/200306.mbox/%3CC478F274880F434EA3A666FE16F7BCAB0200B67A AT ACCLUST04EVS1.ugd.att.com%3E

And the follow-up response at

http://mail-archives.eu.apache.org/mod_mbox/httpd-users/200306.mbox/%3cPine.WNT.4.55.0306051514550.288 AT Poste3947.hec.ca%3e

With a recommended fix at

http://www.apacheweek.com/issues/03-01-24#news

We've tried this, but to no avail. The vulnerability still shows.

anyone have any idea on this? we're on apache 1.3.33 on debian linux.

Thanks,
Jeremy






Archive powered by MHonArc 2.6.24.

Top of Page