Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cross-Site-TRACE

Posted by michael on from the uh-oh dept.

quackking writes "Uh-oh! Looks bad for RFC 2068! Kudos to WhiteHat out of Santa Clara, CA for this one. ALL current web servers comply with this RFC, which means they ALL are vulnerable to this newly named attack - XST - cross-site-trace. When misused, TRACE, part of the HTTP protocol, allows an unauthorized script to be passed to a Web server for execution even if the server is secured against running such scripts. Even devices like web-managed routers are open to this."

5 of 299 comments (clear)

  1. not related by benh57 · · Score: 5, Informative
    This vulerability is about sites getting access to other sites' cookies.

    It is not likely to be related to the current DDOS, which seems to be this MS vuln.

  2. The write-up is misleading by Admiral+Burrito · · Score: 5, Informative
    When misused, TRACE, part of the HTTP protocol, allows an unauthorized script to be passed to a Web server for execution even if the server is secured against running such scripts.

    The script is not executed on the server. It is executed on the client.

    This is a sort of cross-site scripting vulnerability, not an "execute arbitrary commands on any web server" vulnerability like the writeup suggests.

  3. This story is crap by evilviper · · Score: 5, Informative

    This story is utter alarmist crap. There is nothing wrong with TRACE, and the internet is not falling apart. It's just another IE cross-site scripting vulnerability. Here's a few choice links from the discussion on bugtraq:

    http://online.securityfocus.com/archive/1/307778/2 003-01-22/2003-01-28/0
    http://online.securityfocus.com/archive/1/308165/2 003-01-22/2003-01-28/0

    --
    Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  4. THE XSL VULNERABILITY IS SNAKE OIL by defile · · Score: 5, Informative

    If your applications aren't vulnerable to XSS, you have nothing to worry about w.r.t. HTTP TRACE. If your applications ARE vulnerable to XSS, you have bigger problems than HTTP TRACE.

    If users visiting other sites somehow have untrusted code running in them, which performs an HTTP TRACE to your site, the user's browser is broken for not enforcing domain restrictions.

    Ignore this advisory, it's sensationalist snakeoil. Leaving HTTP TRACE enabled is harmless (although you probably don't use it, so disable it anyway).

  5. Read BugTraq by Goodbyte · · Score: 5, Informative

    As been discussed on BugTraq the latest days, this is not a 'general' vunerablility, rather a bug in Microsoft's XMLHTTP component (nomatter what the whitepaper says).

    References: RE: TRACE used to increase the dangerous of XSS.
    Original posting to Bugtraq