RE: Possible iSeries HTTP vulnerabilties TRACE and/or TRACK methods

[John Jones <chianime@xxxxxxxxx>]

Putty, mentioned in another thread today,  can be used for regular telnet.
On Jan 14, 2014 4:42 PM, "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx> wrote:

> V6R1 info center shows default is on.
> V7R1 info center show default is off.
> Did the default change from V6R1 to V7R1, or could there be a typo in the
> center.
>
> With Windows7 , can't use the recommended TELNET test to confirm the
> status.
>
> "Normally you will have this enabled by default, but if you want to test
> if it is really enabled on your server you just have to telnet on the port
> your web server is running and request for "TRACE / HTTP/1.0" if you get a
> positive reply it means TRACE is enabled on your system.
>
> Any recommendations on how to confirm.
>
>
> -----Original Message-----
> From: Steinmetz, Paul
> Sent: Tuesday, January 14, 2014 4:19 PM
> To: 'Midrange Systems Technical Discussion'
> Subject: RE: Possible iSeries HTTP vulnerabilties TRACE and/or TRACK
> methods
>
> So even if TraceEnable is not in the httpconf file, by default it is off.
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
> midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Nadir Amra
> Sent: Tuesday, January 14, 2014 3:35 PM
> To: Midrange Systems Technical Discussion
> Subject: Re: Possible iSeries HTTP vulnerabilties TRACE and/or TRACK
> methods
>
> According to the InfoCenter directive reference, if not specified the
> default is
>
> TraceEnable off
>
> [1]
>
> http://pic.dhe.ibm.com/infocenter/iseries/v7r1m0/index.jsp?topic=%2Frzaie%2Frzaiemod_core.htm
>
>
> Nadir Amra
>
>
>
>
> From:   "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
> To:     "'Midrange Systems Technical Discussion'"
> <midrange-l@xxxxxxxxxxxx>,
> Date:   01/14/2014 02:29 PM
> Subject:        Possible iSeries HTTP vulnerabilties TRACE and/or TRACK
> methods
> Sent by:        midrange-l-bounces@xxxxxxxxxxxx
>
>
>
>
> Security audit is requesting that these vulnerabilities be disabled.
> Reviewing the httpd.conf config files, I see no evidence of TRACE and/or
> TRACK, so I'm assuming these are on by default, and need to be disabled by
> one of the suggested methods.
> All of our HTTP instances are Apache 2.2.11(i5).
> Am I correct that I need to re-visit every HTTP instance, adding one of
> the two recommendations below.
>
> To disable
> TraceEnabled Off
>
> OR
> ...
> # disable TRACE in the main scope of httpd.conf RewriteEngine On
> RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F] ...
> <VirtualHost www.example.com>
> ...
> # disable TRACE in the www.example.com virtual host RewriteEngine On
> RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F] </VirtualHost>
>
> mod_rewrite must be active for these directives to be accepted. If
> mod_rewrite is not already active in your configuration:
>
>
>  Plugin Text: Synopsis: Debugging functions are enabled on the remote web
> server.
> Description: The remote web server supports the TRACE and/or TRACK
> methods. TRACE and TRACK are HTTP methods that are used to debug web
> server connections.
> Solution: Disable these methods. Refer to the plugin output for more
> information.
> See Also:
> http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf
> http://www.apacheweek.com/issues/03-01-24
> http://download.oracle.com/sunalerts/1000718.1.html
> Risk Factor: Medium
> CVSS Base Score: 4.3
> CVSS Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
> CVSS Temporal Score: 3.9
> CVSS Temporal Vector: CVSS2#E:F/RL:W/RC:C
> Plugin Output:
> To disable these methods, add the following lines for each virtual
> host in your configuration file :
> RewriteEngine on
> RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
> RewriteRule .* - [F]
> Alternatively, note that Apache versions 1.3.34, 2.0.55, and 2.2
> support disabling the TRACE method natively via the 'TraceEnable'
> directive.
> Nessus sent
>
>
> Thank You
> _____
> Paul Steinmetz
> IBM i Systems Administrator
>
> Pencor Services, Inc.
> 462 Delaware Ave
> Palmerton Pa 18071
>
> 610-826-9117 work
> 610-826-9188 fax
> 610-349-0913 cell
> 610-377-6012 home
>
> psteinmetz@xxxxxxxxxx
> http://www.pencor.com/
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.