Hi, i found a site where to check for security holes in domino, http://sans20.qualys.com.
so i did a check and found 2 vulnerabilities in my domino i like to fix.
first it says my webserver HTTP trace method supports cross site tracing vulnerability.
so i searched this forum and found one topic, but in my server i don’t have a “web site configuration document”, do i tried to disable trace method in my server document → internet protocols → http → exclude from logging → methods and put TRACE in there.
further i edited my httpd.cnf and added
Enable GET
Enable HEAD
Enable POST
Disable PUT
Disable DELETE
Disable OPTIONS
Disable TRACE
Disable CONNECT
after reloading domino, the vulnerability still appears when checking.
so who can tell me where to disable TRACE method?
Second vulnerablility showing is “lotus domino username enumeration vulnerability”. Definition:
An issue was reported in Lotus Domino server, which could allow for remote users to determine the validity of a username existing on a host. When a remote user submits a GET request for a possible user’s account, the server response assists the user in determining the validity of the username submitted. If the submitted username is valid, the server replies with an HTTP 200 OK message and the login screen. Alternatively, when the submitted username is not valid (meaning that it does not exist on the system), the server responds with a 404 File not Found message. Because the server responds differently depending on whether or not the username is valid, a remote user can test and enumerate possible usernames.
So, can anyone tell me what i can do to fix this?
Regards, Wolf