Internetworkers: http://www.ibiblio.org/internetworkers/

["Matt Pusateri" <mpusateri AT wickedtrails.com>]

On Wed, March 30, 2005 1:11 pm, jeremy snyder said:
> hi,
>
> my company is getting a security audit by a very large prospective
> customer.
> the customer ran a vulnerability scan on our production network, and
> found a
> "TRACE HTTP method enabled" vulnerability.
>
> we've googled like crazy trying to find a solution. we've found this
> comment
>
> You can see
> http://mail-archives.eu.apache.org/mod_mbox/httpd-users/200306.mbox/%3CC478F274880F434EA3A666FE16F7BCAB0200B67A AT ACCLUST04EVS1.ugd.att.com%3E
>
> And the follow-up response at
>
> http://mail-archives.eu.apache.org/mod_mbox/httpd-users/200306.mbox/%3cPine.WNT.4.55.0306051514550.288 AT Poste3947.hec.ca%3e
>
> With a recommended fix at
>
> http://www.apacheweek.com/issues/03-01-24#news
>
> We've tried this, but to no avail. The vulnerability still shows.
>
> anyone have any idea on this? we're on apache 1.3.33 on debian linux.
>
> Thanks,
> Jeremy

Does it show when you run Nikto or Nessus?  If not maybe you can
convince them that your own security audits show it's not a problem.