Re:

[stevepitcher@xxxxxxxxxxxxx]

I'd also disable port 80 and run everything over HTTPS.  Since you're
talking security and all...



On 2013-07-22, at 10:15 AM, "Chris Whisonant" <chris.whisonant@xxxxxxxxx>
wrote:

> If the trace method is not needed for your Quickr/HTTP servers, then just
> disable it in your HTTP configuration (server document).
>
>
> ---------------------------------------------------
>
> Thanks,
> Chris
> Personal Blog: http://cwhisonant.gotdns.com
> Work Blog: http://www.bleedyellow.com/blogs/lotusnut
>
>
> On Mon, Jul 22, 2013 at 9:07 AM, <rob@xxxxxxxxx> wrote:
>
> > We use QualysGuard to test our system for exploitations.  I believe
it's
> > an IBM owned company.  It has this issue with our Domino (and/or
Quickr)
> > served external websites.  It this something to be concerned about?  If
so
> > what actions are recommended?
> >
> >
> >
> >
> > 208.87.182.41 (xqp02.dekko.com, -)
> >
> > OS/400 on AS/400
> > Vulnerabilities (4)   Expand all vulnerabilities Collapse all
> > vulnerabilities
> >
> > 3
> >         HTTP TRACE / TRACK Methods Enabled      port 80/tcp
> >
> >
> > QID:
> >     12680
> > Category:
> >     CGI
> > CVE ID:
> >     CVE-2004-2320 CVE-2010-0386 CVE-2003-1567
> > Vendor Reference
> >     -
> > Bugtraq ID:
> >     -
> > Service Modified:
> >     06/05/2013
> > User Modified:
> >     -
> > Edited:
> >     No
> > PCI Vuln:
> >     Yes
> >
> > THREAT:
> >     The remote Web server supports the TRACE and/or TRACK HTTP methods,
> > which makes it easier for remote attackers to steal cookies and
> > authentication credentials or bypass the HttpOnly protection mechanism.
> > IMPACT:
> >     If this vulnerability is successfully exploited, attackers can
> > potentially steal cookies and authentication credentials, or bypass the
> > HttpOnly protection mechanism.
> > SOLUTION:
> >     Disable these methods in your web server's configuration file.
> > COMPLIANCE:
> >     Not Applicable
> > EXPLOITABILITY:
> >     There is no exploitability information for this vulnerability.
> > ASSOCIATED MALWARE:
> >     There is no malware information for this vulnerability.
> > RESULTS:
> >     TRACE method enabled on / directory
> >
> >
> >
> > Rob Berendt
> > --
> > IBM Certified System Administrator - IBM i 6.1
> > Group Dekko
> > Dept 1600
> > Mail to:  2505 Dekko Drive
> >           Garrett, IN 46738
> > Ship to:  Dock 108
> >           6928N 400E
> >           Kendallville, IN 46755
> > http://www.dekko.com
> >
> > _______________________________________________
> > This is the Lotus Domino on the IBM i (AS/400 and iSeries) (Domino400)
> > mailing list
> > To post a message email: Domino400@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/domino400
> > or email: Domino400-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/domino400.
> _______________________________________________
> This is the Lotus Domino on the IBM i (AS/400 and iSeries) (Domino400)
mailing list
> To post a message email: Domino400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/domino400
> or email: Domino400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/domino400.