07-08-2014 05:32 AM
Hi,
In our ACC I can see that the status bar is 3.7, thanks to the vulnerability HTTP OPTIONS Method. The problem is that I have no idea what this is and how I can fix this.
How can I fix this problem?
07-08-2014 09:52 AM
As Dave mentioned, you would need to turn this off on the web server.
With Microsoft IIS you would use user request filtering to remove the options keyword.
Use Request Filtering : The Official Microsoft IIS Site
You may also be interesting in the MS Technet article on hardening production IIS servers and the lockdown tool.
07-08-2014 06:39 AM
The OPTIONS method is used by the client to find out what are the HTTP methods and other options supported by a web server. The client can specify a URL for the OPTIONS method, or an asterisk (*) to refer to the entire server. The following example request a list of methods supported by a web server running on tutorialspoint.com:
OPTIONS * HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
________________
How to fix the issue:
From what I have researched, I believe you can only configure your web servers to not allow this method. There is nothing on the firewall that can be done.
07-08-2014 09:52 AM
As Dave mentioned, you would need to turn this off on the web server.
With Microsoft IIS you would use user request filtering to remove the options keyword.
Use Request Filtering : The Official Microsoft IIS Site
You may also be interesting in the MS Technet article on hardening production IIS servers and the lockdown tool.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
