apache TRACE/TRACK disable

[mickalo]

I've been informed that using Apache TRACE/TRACK method is can cause security issues. How does one disable this, couldn't find anything in the httpd.conf file referencing this. We running Apache 2.2.10 w/latest Stable Cpanel.

Thx's

Mike

 

[nickp666]

mod_security will help in this instance, here is a rule that will do it

# deny TRACE method
SecRule REQUEST_METHOD "trac(?:e|k)" \
	"phase:1,t:lowercase,id:340002,rev:2,severity:2,msg:'TRACE/TRACK method denied'"

 

[mickalo]

thanks for the info, we'll add it to mod security rules.

Mike