Test Kennung:	1.3.6.1.4.1.25623.1.0.11213
Kategorie:	Web Servers
Titel:	HTTP Debugging Methods (TRACE/TRACK) Enabled
Zusammenfassung:	The remote web server supports the TRACE and/or TRACK; methods. TRACE and TRACK are HTTP methods which are used to debug web server connections.
Beschreibung:	Summary: The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. Vulnerability Insight: It has been shown that web servers supporting this methods are subject to cross-site-scripting attacks, dubbed XST for Cross-Site-Tracing, when used in conjunction with various weaknesses in browsers. Vulnerability Impact: An attacker may use this flaw to trick your legitimate web users to give him their credentials. Affected Software/OS: Web servers with enabled TRACE and/or TRACK methods. Solution: Disable the TRACE and TRACK methods in your web server configuration. Please see the manual of your web server or the references for more information. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2003-1567 CERT/CC vulnerability note: VU#288308 http://www.kb.cert.org/vuls/id/288308 http://www.aqtronix.com/Advisories/AQ-2003-02.txt http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html http://www.osvdb.org/5648 Common Vulnerability Exposure (CVE) ID: CVE-2004-2320 http://dev2dev.bea.com/pub/advisory/68 BugTraq ID: 9506 http://www.securityfocus.com/bid/9506 CERT/CC vulnerability note: VU#867593 http://www.kb.cert.org/vuls/id/867593 http://www.osvdb.org/3726 http://www.securitytracker.com/alerts/2004/Jan/1008866.html http://secunia.com/advisories/10726 XForce ISS Database: weblogic-trace-xss(14959) https://exchange.xforce.ibmcloud.com/vulnerabilities/14959 Common Vulnerability Exposure (CVE) ID: CVE-2004-2763 http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html Common Vulnerability Exposure (CVE) ID: CVE-2005-3398 BugTraq ID: 15222 http://www.securityfocus.com/bid/15222 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445 http://securitytracker.com/id?1015112 http://secunia.com/advisories/17334 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1 http://www.vupen.com/english/advisories/2005/2226 Common Vulnerability Exposure (CVE) ID: CVE-2006-4683 AIX APAR: IC47088 ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf BugTraq ID: 19915 http://www.securityfocus.com/bid/19915 http://secunia.com/advisories/21802 http://www.vupen.com/english/advisories/2006/3532 Common Vulnerability Exposure (CVE) ID: CVE-2007-3008 BugTraq ID: 24456 http://www.securityfocus.com/bid/24456 http://www.appwebserver.org/forum/viewtopic.php?t=996 http://www.osvdb.org/35511 http://secunia.com/advisories/25636 XForce ISS Database: mbedthis-httptrace-xss(34854) https://exchange.xforce.ibmcloud.com/vulnerabilities/34854 Common Vulnerability Exposure (CVE) ID: CVE-2008-7253 Common Vulnerability Exposure (CVE) ID: CVE-2009-2823 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html BugTraq ID: 36956 http://www.securityfocus.com/bid/36956 http://www.mandriva.com/security/advisories?name=MDVSA-2009:300 http://www.vupen.com/english/advisories/2009/3184 Common Vulnerability Exposure (CVE) ID: CVE-2010-0386 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200942-1 Common Vulnerability Exposure (CVE) ID: CVE-2012-2223 XForce ISS Database: novell-zenworks-xplat-xst(74818) https://exchange.xforce.ibmcloud.com/vulnerabilities/74818 Common Vulnerability Exposure (CVE) ID: CVE-2014-7883 HPdes Security Advisory: HPSBMU03239 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04553906 HPdes Security Advisory: SSRT101848 http://www.securitytracker.com/id/1031688
Copyright	Copyright (C) 2003 E-Soft Inc.

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.