Disable TRACE/TRACK methods
We run a secure web service using your SunONE Application Server. The latest version of the Nessus network scanner reports that there is a vunerability in the web server. How do I disable the TRACE and TRACK HTTP methods so that the web server won't respond to them.
http://www.whitehatsec.com/press_release/WH-PR-20030120.pdf
Thanks
Matt Shaw
Please have a look at this site:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603
Sun Alert ID: 50603
Synopsis: Sun ONE/iPlanet Web Server Enable HTTP TRACE Method by Default
Category: Security
Product: iPlanet Web Server, Sun ONE Web Server
BugIDs: 4808654
Avoidance: Workaround
State: Resolved
Date Released: 11-Feb-2003
Date Closed: 11-Feb-2003
Similar Messages
-
Disabling Web Server HTTP Trace/Track Method
How is it possible to disable the Web Server HTTP Trace/Track Method under SJS 7.x?
As per out internal Qualys Scan report:
A Web server was detected that supports the HTTP TRACE method. This method allows debugging and connection trace analysis for connections from the client to the Web server. Per the HTTP specification, when this method is used, the Web server echoes back the information sent to it by the client unmodified and unfiltered. Microsoft IIS web server uses an alias TRACK for this method, and is functionally the same.
A vulnerability related to this method was discovered. A malicious, active component in a Web page can send Trace requests to a Web server that supports this Trace method. Usually, browser security disallows access to Web sites outside of the present site's domain. Although unlikely and difficult to achieve, it's possible, in the presence of other browser vulnerabilities, for the active HTML content to make external requests to arbitrary Web servers beyond the hosting Web server. Since the chosen Web server then echoes back the client request unfiltered, the response also includes cookie-based or Web-based (if logged on) authentication credentials that the browser automatically sent to the specified Web application on the specified Web server.http://blogs.sun.com/meena/entry/disabling_trace_in_sun_java
-
Disabling the HTTP TRACE and TRACK Methods
Greetings,
Due to a security audit, I need to have the proxy reject requests containing the HTTP TRACE or TRACK methods. I have a proxy set up which listens on port 80 and simply redirects all requests to another proxy, which only accepts requests on 443. I thought that I would start by disabling TRACE/TRACK in the port 80 proxy. Here is a portion of my obj.conf for the port 80 proxy:
<Object name="default">
AuthTrans fn="match-browser" browser=".*MSIE.*" ssl-unclean-shutdown="true"
<Client method="TRACE">
Service fn="deny-service"
</Client>
<Client security="off">
NameTrans fn="redirect" from="/" url="https://www.site.com/Site"
</Client>
PathCheck fn="url-check"
ObjectType fn="block-ip"
Service fn="deny-service"
AddLog fn="flex-log" name="access"
</Object>
It seems that the server simply ignores the first <Client> tag and processes the second one. Even when I telnet to the proxy on port 80, and issue a "TRACE /" request, all it does is redirect me to www.site.com/Site. Can someone point me in the right direction here? Where is the best or proper place to intercept requests involving these methods?
Thanks,
ChrisPlease try moving the <Client> tag to the protocol-specific object. For example:
<Object ppath="http://.*">
<Client method="TRACE">
Service fn="deny-service"
</Client>
Service fn="proxy-retrieve" method="*"
</Object> -
Oracle 8.1.7 with OSE affected by HTTP TRACE / TRACK vulnerability
Hi All,
I had no luck using the search function for the problem I'm facing. As for the possibility of posting this in the wrong category, I apologize.
I'm supporting an application that uses Oracle 8.1.7 in a Solaris 9 environment. The web server in use is Apache 1.3.12.
In a security scan, the HTTP TRACK/TRACE vulnerability was found on port 8080. I immediately checked the apache config file (httpd.conf) and found that the apache instance runs on port 7777 and the TRACE and TRACK method is already disabled.
With some help from a colleague, I found that the Oracle Servlet Engine (OSE) admin service is running on port 8080. Disabling this service is not an option because it renders the application unusable. How can I disable these HTTP methods?
If more information is required, do ask.It still seems incredibly low priority to me - I'm not sure if you could even exploit that vulnerability in this instance, even somone did get onto your network.
But, you could configure requests to be routed via the http server http://download.oracle.com/docs/cd/A87860_01/doc/java.817/a83720/modi_apa.htm#77221 - which will filter out the track/trace requests, but I'm not sure if you could disable direct access to the servlet engine.
Apart from that, not really sure. -
Hi
Can anyone tell me how I can disable the HTTP OPTIONS method in Sun One Web Server 6.0 SP4.
Thanks1) Why would TRACE and OPTION request specifying HTTP 1.0 vs. 1.1 yield such different results?
Web Server 6.0 only implements the TRACE and OPTIONS methods for HTTP/1.1, not HTTP/1.0. This is reasonable as TRACE and OPTIONS are part of the HTTP/1.1 protocol and not the HTTP/1.0 protocol.
In other words, TRACE is always disabled for HTTP/1.0 requests, even if you don't use the set-variable work around.
2) Is the OPTIONS command a legitimate test of whether this fix works? If it is, has anyone managed to have the command return an "Allow:" line MINUS the TRACE?
Nope, not in Web Server 6.0. OPTIONS will always list TRACE. (Note that in Web Server 6.1, TRACE is not as tightly integrated into the server core. As a result, OPTIONS will conditionally list TRACE in 6.1.)
3) Has anyone managed to generate a 501 error message after specifying TRACE / HTTP/1.1 instead of 1.0?
Nope, not in Web Server 6.0.
4) Does this fix really work?
I wouldn't call it a fix; it's a work around. However, it does effectively disable TRACE. The work around is a bit of a kludge, resulting in the odd 413 status code.
The real "fix" appears in Web Server 6.1 where you can disable TRACE simply by commenting out the Service method="TRACE" fn="service-trace" line in obj.conf. -
How to disable trace files in oracle version 11g
Senario : trace file are growing
How to disable trace files in oracle version 11g
pls guide with best practiceSHANOJ wrote:
Senario : trace file are growing
How to disable trace files in oracle version 11g
pls guide with best practiceIn 11g, there is an extensive tracing that happens for the reasons best known to Oracle only. But if you want to disable it, Coskan had published a small post mentioning an undocumented parameter(which means you must think twice before using it) to disable it- disablehealth_check* . You may want to read the complete post here,
http://coskan.wordpress.com/2009/06/03/too-many-trace_file-on-11g/
Aman.... -
how can i use google without being tracked...if i disable google tracking the google search results won't direct me to listed web sites..also how do i stop people from knowing my address and location
specifically if i disable the "disable google tracking" add-on...then when i click on a search result it takes me to the website.Hi,
You can try [https://addons.mozilla.org/en-US/firefox/addon/google-search-link-fix/ this] add-on. -
How to disable PUT/DELETE method in SMC tomcat
Hi,
SMC provides tomcat as the web server to allow logon the SMC console through IE.
For security consideration, we have to disable the http "PUT" and "DELETE" method of tomcat. Its config file seems to be /opt/SUNWsymon/web/conf/catalina.policy, but I have no knowledge of this file.
Do anyone know how to disable PUT/DELETE method in tomcat? Or provide me a reference book for this issue?
Thanks a lot.For security consideration, we have to disable the
http "PUT" and "DELETE" method of tomcat. Its config
file seems to be
/opt/SUNWsymon/web/conf/catalina.policy, but I have
no knowledge of this file.I'm not sure how to disable that feature, but be aware if you disable the ability for Agents to send files to the SunMC web server you may break all Configuration Tasks. Agent config files are sent to the Server by HTTP to allow them to be stored as templates/snapshots.
I don't remember seeing instructions on how to make the changes you want: the quickest way to find out is probably to call SunMC support.
Regards,
[email protected] -
How can I fully trace / track a message from the intial smtp connection to the delivery to the exact folder delivered to? I have a client that's randomly missing emails on an almost daily basis. I've set up a catch all mailbox that receives every deliverable email for this domain. This mailbox receive the copy of the message, however the message is not delivered to or can not be found in his mail directory.
OS X 10.6.8
Local Filtering on the Servers Turnded off - we have a 3rd parting filtering company. I can see the message arriving in the mail.log for this user and immediatly after for the catch all address. Its not the filtering company.
Since I can see it land in the mail.log being sent to dovecot, how can I get dovecot to log everything its doing?Hi,
Thanks for the reminder. Yeah, you're are right, I should have the given the link so as to save others time. The question has been answered on the other forum where I had posted. Here is the link:
[http://www.coderanch.com/t/465678/Other-JSE-JEE-APIs/java/track-Email-Messages|http://www.coderanch.com/t/465678/Other-JSE-JEE-APIs/java/track-Email-Messages]
Thanks for the help! -
HT4623 I just lost my iPhone 4, then someone picked it up & disable the tracking feature.
Note I just lost my iPhone 4, then someone picked it up & disable the tracking feature in iCloud.
If that person use this stolen iPhone, can apple store trackiong him & blocked him? or even reset the phone status to default. Serial # of this iPhone is 86107QW6A4T.
Note iPhone is now a very personal item in life, we may drop & lost, or even stolen or by attack to kinapped, strongly request Apple can do something to protect their loyalty customers & their image, no one can stole iPhone, no one can use something which not belong to them, once the device is registrate, only change with by actual owner's authorization whne them sell or gift.
Even your turn off the tracking feature of Find My iPhone, but we still can found by seria # with GPS founction. Is this against the law of privacy?The phone can no longer be tracked by you if it's not signed into your apple id, not even by Apple. It can't be tracked by the serial number either.
The registration of the device can be changed by the person who has access to the serial number, which I know is unfortunate, but that's how it works.
It's against the law to steal an iPhone, for sure.
If the tracking feature of Find my iPhone is turned off, the device is no longer broadcasting a GPS signal. If someone were to sign into the phone with their apple id, it would then be trackable by them but by no one else
It's against Apple's Privacy Policy to access personal information on the phone unless they explicitly need it for troubleshooting purposes. This is unfortunately not one of those instances.
The best thing you can do is call your local law enforcement and report the phone as stolen -
My Ipad got stolen and i want to know how do i Trace/Track it
My Ipad got stolen and i want to know how do i Trace/Track it.
This has nothing to do with iPhones or iPhones in the Enterprise. In the future, please post to the appropriate forum.
Unless "Find My iDevice" was enabled on the device prior to it being lost, there is no way to track it. -
Hello
I have a UN60H6350AFX/ZA fitted with a VG-STC4000/ZA and everything works fine, is there a way of disable camera tracking? it follows everything it moves in the room and I would like to disable this feature.
If not possible, is there a place to submit an RFE?
ThanksHi Leigh,
We are running into the same issue with needing to only apply external tracking to links going to our websites. We have a lot of clients who we post ads for in our newsletters, and we are wanting to disable external tracking for their links.
Sometimes their sites don't accept foreign query strings which causes the URL to come up with an error page.
We also have clients who use the same standard query strings as we do, and they provide their links with these query strings already applied. When Eloqua then applies our external tracking query strings they overwrite the client's values.
Is there any query string that can be appended to a URL that will tell it to ignore external tracking for that link? Or can you think of any other workarounds? We have tried using redirect links, and are able to get around the main issue, but then when we have to report back to our clients, the links contacts are clicking on are not the URLs they provided. We can replace the redirect URL with the client's URL manually, but we send hundreds of newsletters from all of our different brands, so this manual workaround has become a bit of a nightmare.
If there is nothing out their currently, is their anything in the roadmap that might support this functionality? I read in another post from Jeff Butwell that it is a feature that is being considered (Can you manually override Google Analytics external tracking in an email?). This was over a year ago.
Thanks!
Ben -
Hello,
Is it possible to disable external tracking on a link-by-link or email-by-email basis? I've run into a few sites that we need to link to which do not cooperate with the appended query string parameters, some which disagree so much that they throw up an error page listing the parameters as unknown instead of displaying the content we intended our audience to see.
The only way to disable this that I have found is through unchecking the box Setup > Email Configuration > [_] External Tracking - but that's an account-wide setting, and this is only required on a case-by-case basis.
Thanks,
RichardHi Leigh,
We are running into the same issue with needing to only apply external tracking to links going to our websites. We have a lot of clients who we post ads for in our newsletters, and we are wanting to disable external tracking for their links.
Sometimes their sites don't accept foreign query strings which causes the URL to come up with an error page.
We also have clients who use the same standard query strings as we do, and they provide their links with these query strings already applied. When Eloqua then applies our external tracking query strings they overwrite the client's values.
Is there any query string that can be appended to a URL that will tell it to ignore external tracking for that link? Or can you think of any other workarounds? We have tried using redirect links, and are able to get around the main issue, but then when we have to report back to our clients, the links contacts are clicking on are not the URLs they provided. We can replace the redirect URL with the client's URL manually, but we send hundreds of newsletters from all of our different brands, so this manual workaround has become a bit of a nightmare.
If there is nothing out their currently, is their anything in the roadmap that might support this functionality? I read in another post from Jeff Butwell that it is a feature that is being considered (Can you manually override Google Analytics external tracking in an email?). This was over a year ago.
Thanks!
Ben -
Is it possible to disable the track pad while typing?
Is it possible to disable the track pad while typing?
I don't believe there is a way to do it natively.
However there is an app called BetterTouchTool which enables you to fully customize the trackpad. You could increase the sensitivities so that it doesn't activate while your typing.
Hope this helps. -
How to disable TRACE on Web Application Server v 7.0?
Hello Professional Sun Users,
According to:
http://blogs.sun.com/meena/entry/disabling_trace_in_sun_java
I can disable HTTP TRACE by either through:
1. Adding the following code into obj.conf
<Client method="TRACE">
AuthTrans fn="set-variable"
remove-headers="transfer-encoding"
set-headers="content-length: -1"
error="501"
</Client>
which I get 413 Request Entity Too Large
here is my obj.conf file:
# Sun Microsystems, Inc. - obj.conf
# You can edit this file, but comments and formatting changes
# might be lost when the admin server makes changes.
# Use only forward slashes in pathnames--backslashes can cause
# problems. See the documentation for more information.
<Object name="default">
<Client method="TRACE">
AuthTrans fn="set-variable" remove-headers="transfer-encoding" set-headers="content-length: -1" error="501"
</Client>
AuthTrans fn="match-browser" browser="*MSIE*" ssl-unclean-shutdown="true"
NameTrans fn="ntrans-j2ee" name="j2ee"
NameTrans fn="pfx2dir" from="/mc-icons" dir="D:/Sun/AppServer7U10/lib/icons" name="es-internal"
NameTrans fn="document-root" root="$docroot"
PathCheck fn="nt-uri-clean"
PathCheck fn="find-pathinfo"
PathCheck fn="find-index" index-names="index.html,home.html"
PathCheck fn="check-acl" acl="default"
ObjectType fn="type-by-extension"
ObjectType fn="force-type" type="text/plain"
Service method="(GET|HEAD)" type="magnus-internal/imagemap" fn="imagemap"
Service method="(GET|HEAD)" type="magnus-internal/directory" fn="index-common"
Service method="(GET|HEAD|POST)" type="*~magnus-internal/*" fn="send-file"
Error fn="error-j2ee"
AddLog fn="flex-log" name="access"
</Object>
<Object name="j2ee">
ObjectType fn="force-type" type="text/html"
Service fn="service-j2ee" method="*"
</Object>
<Object name="cgi">
ObjectType fn="force-type" type="magnus-internal/cgi"
Service fn="send-cgi"
</Object>
<Object name="es-internal">
PathCheck fn="check-acl" acl="es-internal"
</Object>
or
2. adding the following code into generated.server1.acl and genwork.server1.acl
deny absolute (http_trace, http_put, http_delete, http_move, http_mkdir, http_rmdir) user="anyone";
which I get 200 OK
My generated.server1.acl file:
version 3.0;
acl "default";
authenticate (user, group) {
prompt = "Sun ONE Application Server";
deny absolute (http_trace, http_put, http_delete, http_move, http_mkdir, http_rmdir) user="anyone";
acl "es-internal";
deny absolute (http_trace, http_put, http_delete, http_move, http_mkdir, http_rmdir) user="anyone";
and genwork.server1.acl file:
version 3.0;
acl "default";
authenticate (user, group) {
prompt = "Sun ONE Application Server";
deny absolute (http_trace, http_put, http_delete, http_move, http_mkdir, http_rmdir) user="anyone";
acl "es-internal";
deny absolute (http_trace, http_put, http_delete, http_move, http_mkdir, http_rmdir) user="anyone";
Both methods of disabling HTTP TRACE seems not working......... Could anyone point where had went wrong?
Thank you
Edited by: draggy on Jan 5, 2009 8:28 AMHello Joe,
Thank you for replying.
However I did recheck everything
here my /server1/config/obj.conf:
# Use only forward slashes in pathnames--backslashes can cause
# problems. See the documentation for more information.
<Object name="default">
<Client method="TRACE">
AuthTrans fn="set-variable" remove-headers="transfer-encoding" set-headers="content-length: -1" error="501"
</Client>
AuthTrans fn="match-browser" browser="*MSIE*" ssl-unclean-shutdown="true"
NameTrans fn="ntrans-j2ee" name="j2ee"
NameTrans fn=pfx2dir from=/mc-icons dir="D:/Sun/AppServer7/lib/icons" name="es-internal"
NameTrans fn=document-root root="$docroot"
PathCheck fn=nt-uri-clean
PathCheck fn="check-acl" acl="default"
PathCheck fn=find-pathinfo
PathCheck fn=find-index index-names="index.html,home.html"
ObjectType fn=type-by-extension
ObjectType fn=force-type type=text/plain
Service method=(GET|HEAD) type=magnus-internal/imagemap fn=imagemap
Service method=(GET|HEAD) type=magnus-internal/directory fn=index-common
Service method=(GET|HEAD|POST) type=*~magnus-internal/* fn=send-file
Error fn="error-j2ee"
AddLog fn=flex-log name="access"
</Object>
<Object name="j2ee">
ObjectType fn=force-type type=text/html
Service fn="service-j2ee" method="*"
</Object>
<Object name="cgi">
ObjectType fn=force-type type=magnus-internal/cgi
Service fn=send-cgi
</Object>
<Object name="es-internal">
PathCheck fn="check-acl" acl="es-internal"
</Object>and my /server1/config/server1-obj.conf:
# Use only forward slashes in pathnames--backslashes can cause
# problems. See the documentation for more information.
<Object name="default">
<Client method="TRACE">
AuthTrans fn="set-variable" remove-headers="transfer-encoding" set-headers="content-length: -1" error="501"
</Client>
AuthTrans fn="match-browser" browser="*MSIE*" ssl-unclean-shutdown="true"
NameTrans fn="ntrans-j2ee" name="j2ee"
NameTrans fn=pfx2dir from=/mc-icons dir="D:/Sun/AppServer7/lib/icons" name="es-internal"
NameTrans fn=document-root root="$docroot"
PathCheck fn=nt-uri-clean
PathCheck fn="check-acl" acl="default"
PathCheck fn=find-pathinfo
PathCheck fn=find-index index-names="index.html,home.html"
ObjectType fn=type-by-extension
ObjectType fn=force-type type=text/plain
Service method=(GET|HEAD) type=magnus-internal/imagemap fn=imagemap
Service method=(GET|HEAD) type=magnus-internal/directory fn=index-common
Service method=(GET|HEAD|POST) type=*~magnus-internal/* fn=send-file
Error fn="error-j2ee"
AddLog fn=flex-log name="access"
</Object>
<Object name="j2ee">
ObjectType fn=force-type type=text/html
Service fn="service-j2ee" method="*"
</Object>
<Object name="cgi">
ObjectType fn=force-type type=magnus-internal/cgi
Service fn=send-cgi
</Object>
<Object name="es-internal">
PathCheck fn="check-acl" acl="es-internal"
</Object>I still getting the same 413...
$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
TRACE / HTTP/1.1
HOST: foo
HTTP/1.1 413 Request Entity Too Large
Server: Sun-ONE-Application-Server/7.0.0_01
Date: Tue, 06 Jan 2009 06:32:29 GMT
Content-length: 168
Content-type: text/html
Connection: close
<HTML><HEAD><TITLE>Request Entity Too Large</TITLE></HEAD>
<BODY><H1>Request Entity Too Large</H1>
A request entity is longer than the server can handle.
</BODY></HTML>Connection closed by foreign host.Thank you
Maybe you are looking for
-
SQL-Model-Clause / Example 2 in Data Warehousing Guide 11G/Chapter 24
Hi SQL-Experts I have a RH 5.7/Oracle 11.2-Environment! The sample schemas are installed! I executed as in Example 2 in Data Warehousing Guide 11G/Chapter 24: CREATE TABLE currency ( country VARCHAR2(20), year NUMBER, mont
-
When I first got my MacBook Pro my wireless network at home (Linksys Wireless Router) popped right up and I entered the password and had no problems automatically connected after that. I went to a friends house this weekend who also has a wireless ro
-
.PDF Files blurred in InDesign CC 2014. They will still work if I try to do the same in InDesign CC
.PDF Files blurred in InDesign CC 2014. They will still work if I try to do the same in InDesign CC. I prepare the original in microsoft word and save in a sub-directory as a .pdf. I then use the "Place" command to bring it into the document. Why doe
-
HT4437 Can u air play to a Vizio smart tv from iPhone 5?
Can u airplay from iPhone 5 to a Vizio smart tv?
-
Hi I can see a number of old threads here regarding removing a site through iDisk and I have folowed these but still have a folder remaining (with content) that I cannot remove. I have navivated to the iWeb/Sites folder but whenever I try to deleye t