Track / Trace method on web server

Symptomps:
serverxyz:~ # telnet 127.15.10.36 80
Trying 127.15.10.36…
Connected to 10.17.105.34.
Escape character is ‚^]‘.
TRACE / HTTP/1.0

HTTP/1.1 200 OK
Date: Wed, 22 Aug 2012 12:17:05 GMT
Server: Apache/2.0.52 (Unix) mod_ssl/2.0.52 OpenSSL/0.9.7e
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Connection closed by foreign host.

Solution:
For Apache, add the lines below to httpd.conf
LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine On
RewriteCondi %{REQUEST_METHOD} ^TRACE
RewriteRule .* – [F]

For tomcat, add lines below to between and in web.xml

/*
TRACE

Jan D.
Jan D.

"The only real security that a man will have in this world is a reserve of knowledge, experience, and ability."

Articles: 664