Fix Domino vulnerabilities

Hi, i found a site where to check for security holes in domino, http://sans20.qualys.com.

so i did a check and found 2 vulnerabilities in my domino i like to fix.

first it says my webserver HTTP trace method supports cross site tracing vulnerability.

so i searched this forum and found one topic, but in my server i don’t have a “web site configuration document”, do i tried to disable trace method in my server document → internet protocols → http → exclude from logging → methods and put TRACE in there.

further i edited my httpd.cnf and added

Enable GET

Enable HEAD

Enable POST

Disable PUT

Disable DELETE

Disable OPTIONS

Disable TRACE

Disable CONNECT

after reloading domino, the vulnerability still appears when checking.

so who can tell me where to disable TRACE method?

Second vulnerablility showing is “lotus domino username enumeration vulnerability”. Definition:

An issue was reported in Lotus Domino server, which could allow for remote users to determine the validity of a username existing on a host. When a remote user submits a GET request for a possible user’s account, the server response assists the user in determining the validity of the username submitted. If the submitted username is valid, the server replies with an HTTP 200 OK message and the login screen. Alternatively, when the submitted username is not valid (meaning that it does not exist on the system), the server responds with a 404 File not Found message. Because the server responds differently depending on whether or not the username is valid, a remote user can test and enumerate possible usernames.

So, can anyone tell me what i can do to fix this?

Regards, Wolf

Subject: Fix Domino vulnerabilities

Just run the test on our Domino 6.5 but the test didn’t find any vulnerability at all (for almost 10 minutes the console showed hits from the test scanner looking up for NSFs, PHPs, etc…)

We just have an standard install, without any extra security configuration.

Maybe the vulnerability has just been solved in newer versions than 6.0.2CF1

J R