ID de Prueba:	11213
Categoría:	Web Servers
Título:	HTTP Debugging Methods (TRACE/TRACK) Enabled
Resumen:	The remote web server supports the TRACE and/or TRACK; methods. TRACE and TRACK are HTTP methods which are used to debug web server connections.
Descripción:	Summary: The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. Vulnerability Insight: It has been shown that web servers supporting this methods are subject to cross-site-scripting attacks, dubbed XST for Cross-Site-Tracing, when used in conjunction with various weaknesses in browsers. Vulnerability Impact: An attacker may use this flaw to trick your legitimate web users to give him their credentials. Affected Software/OS: Web servers with enabled TRACE and/or TRACK methods. Solution: Disable the TRACE and TRACK methods in your web server configuration. Please see the manual of your web server or the references for more information. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2003-1567 CERT/CC vulnerability note: VU#288308 http://www.kb.cert.org/vuls/id/288308 http://www.aqtronix.com/Advisories/AQ-2003-02.txt http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html http://www.osvdb.org/5648 Common Vulnerability Exposure (CVE) ID: CVE-2004-2320 http://dev2dev.bea.com/pub/advisory/68 BugTraq ID: 9506 http://www.securityfocus.com/bid/9506 CERT/CC vulnerability note: VU#867593 http://www.kb.cert.org/vuls/id/867593 http://www.osvdb.org/3726 http://www.securitytracker.com/alerts/2004/Jan/1008866.html http://secunia.com/advisories/10726 XForce ISS Database: weblogic-trace-xss(14959) https://exchange.xforce.ibmcloud.com/vulnerabilities/14959 Common Vulnerability Exposure (CVE) ID: CVE-2004-2763 http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html Common Vulnerability Exposure (CVE) ID: CVE-2005-3398 BugTraq ID: 15222 http://www.securityfocus.com/bid/15222 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445 http://securitytracker.com/id?1015112 http://secunia.com/advisories/17334 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1 http://www.vupen.com/english/advisories/2005/2226 Common Vulnerability Exposure (CVE) ID: CVE-2006-4683 AIX APAR: IC47088 ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf BugTraq ID: 19915 http://www.securityfocus.com/bid/19915 http://secunia.com/advisories/21802 http://www.vupen.com/english/advisories/2006/3532 Common Vulnerability Exposure (CVE) ID: CVE-2007-3008 BugTraq ID: 24456 http://www.securityfocus.com/bid/24456 http://www.appwebserver.org/forum/viewtopic.php?t=996 http://www.osvdb.org/35511 http://secunia.com/advisories/25636 XForce ISS Database: mbedthis-httptrace-xss(34854) https://exchange.xforce.ibmcloud.com/vulnerabilities/34854 Common Vulnerability Exposure (CVE) ID: CVE-2008-7253 Common Vulnerability Exposure (CVE) ID: CVE-2009-2823 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html BugTraq ID: 36956 http://www.securityfocus.com/bid/36956 http://www.mandriva.com/security/advisories?name=MDVSA-2009:300 http://www.vupen.com/english/advisories/2009/3184 Common Vulnerability Exposure (CVE) ID: CVE-2010-0386 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200942-1 Common Vulnerability Exposure (CVE) ID: CVE-2012-2223 XForce ISS Database: novell-zenworks-xplat-xst(74818) https://exchange.xforce.ibmcloud.com/vulnerabilities/74818 Common Vulnerability Exposure (CVE) ID: CVE-2014-7883 HPdes Security Advisory: HPSBMU03239 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04553906 HPdes Security Advisory: SSRT101848 http://www.securitytracker.com/id/1031688
Copyright	Copyright (C) 2003 E-Soft Inc.

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.