How do I turn off TRACK and TRACE HTTP please.

[Dave-Brown]

I have a goDaddy site scanner and has hit me with the error below.

Can anyone please tell me how to globally turn off track and trace please..

Thanks in advance
Regards
Dave

Status:

Not yet addressed
Synopsis:

The debugging functions TRACK and TRACE HTTP Methods are enabled on your Web server.
Description:

Your website supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods that are used to debug web server connections. These HTTP methods make your website vulnerable to cross‑site scripting and cross‑site tracing attacks.
See Also:

http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf
http://www.apacheweek.com/issues/03-01-24 http://www.kb.cert.org/vuls/id/288308 http://www.kb.cert.org/vuls/id/867593 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200942-1
Risk Factor:

Medium / CVSS Base Score : 4.3(CVSS2#AV:N/AC:M/Au:N/C/I:N/A:N)
Solution:

Disable the TRACK and TRACE methods. To disable these methods, add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] Apache versions 1.3.34, 2.0.55, and 2.2 support disabling the TRACE method natively via the '
TraceEnable'
directive.

Output:

To disable these methods, add the following lines for each virtual
host in your configuration file :
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
Alternatively, note that Apache versions 1.3.34, 2.0.55, and 2.2
support disabling the TRACE method natively via the 'TraceEnable'
directive.
Site Scanner sent the following TRACE request :
------------------------------ snip ------------------------------
TRACE /Site Scanner1129205109.html HTTP/1.1
Connection: Close
Host: weedseeds.ie
Pragma: no-cache
User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; MSIE 6.0; Site Scanner Bot; +http://www.websiteprotection.com) Firefox/2.0.0.3
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
Accept-Language: en
Accept-Charset: iso-8859-1,*,utf-8
------------------------------ snip ------------------------------
and received the following response from the remote server :
------------------------------ snip ------------------------------
HTTP/1.1 200 OK
Date: Sun, 12 Feb 2012 02:58:58 GMT
Server: Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Connection: close
Transfer-Encoding: chunked
Content-Type: message/http

TRACE /Site Scanner1129205109.html HTTP/1.1
Connection: Close
Host: weedseeds.ie
Pragma: no-cache
User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; MSIE 6.0; Site Scanner Bot; +http://www.websiteprotection.com) Firefox/2.0.0.3
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
Accept-Language: en
Accept-Charset: iso-8859-1,*,utf-8
------------------------------ snip ------------------------------
CVE : CVE-2003-1567, CVE-2004-2320, CVE-2010-0386
BID : 9506, 9561, 11604, 33374, 37995
Other references : OSVDB:877, OSVDB:3726, OSVDB:5648, OSVDB:50485, CWE:16

 

[shiliangtu]

I have a goDaddy site scanner and has hit me with the error below.

Can anyone please tell me how to globa

lly turn desktop 7 in the online checkout off track and trace please..

Thanks in advance
Regards
Dave

thanks very much

 

[Dave-Brown]

huh?..??

Spammer alert!