Apache Help

[KPS]

Hi, we're running a few different versions of HP Apache Web-Based Server. We're being told that we need to disable HTTP Trace where it is not needed. I'm not very Apache Knowledgeable and I'm looking for instructions on how to do this on HP-UX 11.0 and 11.11 running the following versions of Apache:

- A.1.0.01.02
- 1.03.12.03
- 1.3.19.23

Any help would be greatly appreciated.

-Ken

[Geoff Wild]

This may help:

http://www.kb.cert.org/vuls/id/867593

Rgds...Geoff

[Bejoy C Alias]

TRACE and TRACK
are HTTP methods which are used to debug web server connections.
It has been shown that servers supporting this method are subject
to cross-site-scripting attacks, dubbed XST for
"Cross-Site-Tracing", when used in conjunction with
various weaknesses in browsers.

An attacker may use this flaw to trick your
legitimate web users to give him their
credentials.

To disable TRACE / TRACK add this at the last of ur httpd.conf file.

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

[KPS]

Folks,

Thanks for the replies. Would anyone happen to know what config file for Apache these changes would be made to disable the HTTP Trace? I was guessing it might be httpd.conf, but I'm not 100% sure.

[Steven E. Protter]

It is probably in the httpd.conf file.

http://httpd.apache.org

Its documented pretty well there.

SEP

[Bejoy C Alias · Accepted solution]

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

This should be added to ur httpd.conf file only.

[KPS]

Thanks for your help everyone!