Test ID:	11213
Category:	Web application abuses
Title:	http TRACE XSS attack
Summary:	Debugging functions are enabled on the remote HTTP server.;;The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK;are HTTP methods which are used to debug web server connections. ;;It has been shown that servers supporting this method are subject to;cross-site-scripting attacks, dubbed XST for Cross-Site-Tracing, when;used in conjunction with various weaknesses in browsers. ;;An attacker may use this flaw to trick your legitimate web users to give;him their credentials.
Description:	Summary: Debugging functions are enabled on the remote HTTP server. The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for Cross-Site-Tracing, when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	BugTraq ID: 9506 BugTraq ID: 9561 BugTraq ID: 11604 Common Vulnerability Exposure (CVE) ID: CVE-2004-2320 http://dev2dev.bea.com/pub/advisory/68 CERT/CC vulnerability note: VU#867593 http://www.kb.cert.org/vuls/id/867593 http://www.securityfocus.com/bid/9506 http://www.osvdb.org/3726 http://www.securitytracker.com/alerts/2004/Jan/1008866.html http://secunia.com/advisories/10726 XForce ISS Database: weblogic-trace-xss(14959) http://xforce.iss.net/xforce/xfdb/14959 Common Vulnerability Exposure (CVE) ID: CVE-2003-1567 http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html http://www.aqtronix.com/Advisories/AQ-2003-02.txt CERT/CC vulnerability note: VU#288308 http://www.kb.cert.org/vuls/id/288308 http://www.osvdb.org/5648
Copyright	This script is Copyright (C) 2003 E-Soft Inc.

This is only one of 56160 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: