Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:M/AU:N/C:P/I:P/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1767955-4)
Описание
BC-SRV-KPR-CS results in a Reflected cross-site scripting issue if HTTP TRACE method is switched on.A reflected cross site scripting attack can be used to non-permanently deface or modify displayed content from a web site.Reflected cross site scripting can be used to steal another user#s authentication information such as data relating to their current session. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application#s security can be may occur.
Как исправить
Please do the below steps to disable the HTTP TRACE in IIS and APACHE respectively.Disable HTTP TRACE in IIS:You can use URLScan to block HTTP Trace verbhttp://support.microsoft.com/?id=326444The urlscan.ini file included as part of URLScan sets by default a configuration setting "UseAllowVerbs=1". Please change this value to 0 i.e "UseAllowVerbs=0", so that the DenyVerbs section will be called and will deny the operations mentioned in that sectionTo deny TRACE verb, then in the [DenyVerbs] section of the urlscan.ini add"TRACE".PS: The [DenyVerbs] section should contain only the TRACE verb and not any other verbs as it will block the content server operations.Once you do the above changes please restart IIS so that changes are taken into effect.Disable HTTP TRACE in APACHE:For apache versions newer than 1.3.34 , and 2.0.55 (or newer) for apache2, there is a new apache variable that controls if TRACE method is enabled or not:TraceEnable offThe above line needs to be added in the httpd.conf file to disable teh HTTP TRACE and the default is enabled (on).Once you do the above changes please restart apache so that changes are taken into effect.
Ссылки
