Skip to content

Lookup Service must not enable support for TRACE requests.

An XCCDF Rule

Description

"TRACE" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a TRACE operation against the service will expose information that would be useful to perform a more targeted attack. Lookup Service provides the "allowTrace" parameter as means to disable responding to TRACE requests.

ID
SV-256730r888781_rule
Version
VCLU-70-000025
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Navigate to and open:

/usr/lib/vmware-lookupsvc/conf/server.xml

Locate and navigate to 'allowTrace="true"'.