You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2009/11/25 00:25:12 UTC
DO NOT REPLY [Bug 48277] New: TraceEnable directive not secure by
default
https://issues.apache.org/bugzilla/show_bug.cgi?id=48277
Summary: TraceEnable directive not secure by default
Product: Apache httpd-2
Version: 2.3-HEAD
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: Core
AssignedTo: bugs@httpd.apache.org
ReportedBy: marsh@extendedsubset.com
HTTP has long defined a TRACE verb.
A well-known paper on web security from 2003
http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf
clearly documents the opportunities for evil provided by TRACE.
Web security scanners warn when TRACE is enabled:
http://nessus.org/plugins/index.php?view=single&id=11213
My recent attack on TLS/SSL
http://extendedsubset.com/Renegotiating_TLS.pdf
highlights the need to disable TRACE. Having TRACE enabled may allow an
attacker to leverage the blind plaintext injection attack into arbitrary evil
script running in the browser from the origin of the target website.
Apache provides a configuration directive to disable TRACE.
http://httpd.apache.org/docs/2.2/mod/core.html#traceenable
However, the default setting leaves it in the enabled, insecure configuration.
It is time to set the default to the secure configuration.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 48277] TraceEnable directive not secure by default
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=48277
Will Rowe <wr...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |FAQ
Status|NEW |RESOLVED
Resolution| |INVALID
--- Comment #1 from Will Rowe <wr...@apache.org> 2009-11-28 14:35:12 UTC ---
[Tagging FAQ for clarification]
TRACE is not a vulnerability, any more than traceroute or ping would be
security
issues. It is simply a tool, and the HTTP project will not disable such tools
by default. The RFC spells out that servers SHOULD implement, therefore we do.
Now, there are entirely moronic clients and programmatic interfaces; old, stale
and badly designed flavors of Microsoft Internet Explorer and Adobe Flash all
spring to mind, which would present the results of a TRACE request to the user.
This is out of the server developers hands, and there are other sinister flaws
hiding in those design errors which 'TraceEnable off' has no effect on.
So marked as an FAQ for the justification why the "security communities'"
request
to address the TRACE directive is entirely invalid. The serious DoS
consideration
would be the reflection of request bodies, which are not enabled by default,
but
only offered as an 'extended' feature for testing server or routing behavior.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org