Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread Eric Covener
On Wed, Jun 10, 2009 at 7:53 AM, Singh, Sukhjeet sukhjeet.si...@fiserv.com wrote: The server allows capture of the HTTP service banner. Service banners can contain sensitive information, such as application and Operating System (OS) version numbers. An attacker can use the version information

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread André Warnier
RE: [us...@httpd] default site RE: [us...@httpd] 503 status seems to get cached - how do I disable caching? Singh, Sukhjeet wrote: (lots of stuff in the wrong threads) 1) would you please stop just hitting the reply button on just any message of this list to post things that have nothing

RE: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread Singh, Sukhjeet
-sa.com] Sent: Wednesday, June 10, 2009 6:25 PM To: users@httpd.apache.org Subject: Re: [us...@httpd] Fixing HTTP Service / Server Version Detected RE: [us...@httpd] default site RE: [us...@httpd] 503 status seems to get cached - how do I disable caching? Singh, Sukhjeet wrote: (lots of stuff

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread André Warnier
or not..? Sukhjeet -Original Message- From: André Warnier [mailto:a...@ice-sa.com] Sent: Wednesday, June 10, 2009 6:25 PM To: users@httpd.apache.org Subject: Re: [us...@httpd] Fixing HTTP Service / Server Version Detected RE: [us...@httpd] default site RE: [us...@httpd] 503 status seems

RE: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread Singh, Sukhjeet
@httpd.apache.org Subject: Re: [us...@httpd] Fixing HTTP Service / Server Version Detected Sukhjeet, let me try one more time. - this is a users help forum dedicated to Apache httpd - considering the content of the server message you showed (see below), I am not sure that what you call the server

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread Dave Floyd
I need to fix this Vulnerability, So can someone please check the vulnerability and let me know the best way to fix the HTTP Service / Server Version. The server allows capture of the HTTP service banner. Service banners can contain sensitive information, such as application and Operating

RE: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread Singh, Sukhjeet
Thanks for your help Dave...!! Sukhjeet -Original Message- From: Dave Floyd [mailto:dave.fl...@pa.press.net] Sent: Wednesday, June 10, 2009 6:58 PM To: users@httpd.apache.org Subject: Re: [us...@httpd] Fixing HTTP Service / Server Version Detected I need to fix this Vulnerability, So

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread André Warnier
Dave Floyd wrote: I need to fix this Vulnerability, So can someone please check the vulnerability and let me know the best way to fix the HTTP Service / Server Version. The server allows capture of the HTTP service banner. Service banners can contain sensitive information, such as

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread Nick Kew
On Wed, 10 Jun 2009 18:28:39 +0530 Singh, Sukhjeet sukhjeet.si...@fiserv.com wrote: Andre, I appreciate your concern but I'll like to let you know that enabling or disabling the HTTP banner should logically come under the server configuration. Your vulnerability isn't the banner, it's the

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread André Warnier
Boyle Owen wrote: I suspect we've had a visitation from a Help Vampire... http://slash7.com/pages/vampires That's a great one ! :-) Did you know this one ? http://www.mail-archive.com/us...@tomcat.apache.org/msg53854.html

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread William A. Rowe, Jr.
Singh, Sukhjeet wrote: The server allows capture of the HTTP service banner. Service banners can contain sensitive information, such as application and Operating System (OS) version numbers. An attacker can use the version information from your Web server to determine if there are any known

Re: [us...@httpd] Fixing HTTP Service / Server Version Detected

2009-06-10 Thread André Warnier
William A. Rowe, Jr. wrote: http://httpd.apache.org/docs/2.2/mod/core.html#servertokens Sadly, this information is useless to you. This is not an httpd issue, it's a JBoss issue. Take it to their user forum. This is not a JBoss support forum. What I've been trying to tell the OP since