Skip to main content

Application Reveals Webserver name and Version in HTTP Response Or WebServer Banner Not Masked

 Application Reveals Webserver name and Version in HTTP Response or WebServer Banner NOT Masked.

One of many security vulnerabilities that a web server faces is revealing webserver name and its version. Often hackers use this information understand the version and induce vulnerabilities applicable to a specific version.

Oracle Application's is one of the most affected as it uses a lower version of Apache web server on till 11i.

Following information can be seen either using iehttpdheaders for IE or yslow for mozilla.

HTTP/1.1 200 OK
Date: Mon, 26 Jul 2010 05:11:47 GMT
Server: Oracle HTTP Server Powered by Apache/1.3.19
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Keep-Alive: timeout=15
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=US-ASCII

Here if you notice it gives in a lot of information than it should.

To mask this banner set the following parameter in your httpd.conf file.

ServerTokens Prod


Once this parameter is set, the header will not display Apache version information.


HTTP/1.1 200 OK
Date: Mon, 26 Jul 2010 05:11:47 GMT
Server: Oracle HTTP Server Powered by Apache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Keep-Alive: timeout=15
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=US-ASCII


To know more about this parameter CLICK HERE


To entirely remove "Server" entry from the header

Add the following line at the end of httpd.conf file and restart Apache services.

ServerHeader Off

Once this is done check the header information using iehttpheaders,


 HTTP/1.1 404 Not Found
Cache-Control: private
Content-Type: text/html
Set-Cookie: JSESSIONID=2a7e464c4de0a32e4a6e8addb59919a8af244f235ecc37aa185866437ac9d56b.e3iOb3eMbheMe34Mb30MbxuSa3f0n6jAmljGr5XDqQLvpAe; path= Connection: Keep-Alive
Keep-Alive: timeout=5, max=999
Content-Length: 166
Date: Tue, 10 May 2011 08:02:09 GMT



Labels:

Comments

Post a Comment

Popular posts from this blog

SQL Interview Questions on Subqueries

SUB Queries:
1. List the employees working in research department 2. List employees who are located in New York and Chicago
3. Display the department name in which ANALYSTS are working
4. Display employees who are reporting to JONES
5. Display all the employees who are reporting to Jones Manager
6. Display all the managers in SALES and ACCOUNTING department
7. Display all the employee names in Research and Sales Department who are having at least 1 person reporting to them
8. Display all employees who do not have any reportees
9. List employees who are having at least 2 reporting
10. List the department names which are having more than 5 employees
11. List department name having at-least 3 salesman
12. List employees from research and accounting having at-least 2 reporting
13. Display second max salary
14. Display 4th max salary
15. Display 5th max salary  -- Answer for nth Max Salary
Co-Related Subqueries:
16. Write a query to get 4th max salary from EMP table
17. Write a query to get 2nd…
20 comments
Read more

Answers for SUB Queries

1. SQL> select empno, ename from emp where deptno=(select deptno from dept where dname='RESEARCH');


2. SQL> select empno, ename from emp where deptno in (select deptno from dept where loc in ('NEW YORK','CHICAGO'));

3. SQL> select dname from dept where deptno in ( select deptno from emp where job ='ANALYST');

4. SQL> select empno, ename, mgr from emp where mgr = (select empno from emp where ename='JONES');

5. SQL> select empno, ename, mgr from emp where mgr = (select mgr from emp where ename='JONES')

6. SQL> select empno, ename, job from emp where deptno in ( select deptno from dept where dname in ('SALES','ACCOUNTING'))

7. SQL> select empno, ename, job from emp where deptno in ( select deptno from dept where dname in ('SALES','RESEARCH')) and empno in (select mgr from emp)

8. SQL> select empno, ename from emp where empno not in ( select mgr from emp where mgr is not null)

9. select…
8 comments
Read more

'Linux-x86_64 Error: 28: No space left on device' While trying to start the database -- Error

SQL> startup mount pfile='/tmp/initdlfasp12.ora'
ORA-27102: out of memory
Linux-x86_64 Error: 28: No space left on device


This as you can see is on Linux x86 with 64 bit processor. We got this error after we changed SGA on 10gR2 database. So was sure that this is something to do with the OS.

Parameters to check for this are shmall.

shmall is the total amount of shared memory, in pages, that the system can use at one time.

$cat /proc/sys/kernel/shmmax
53687091200

$ getconf PAGE_SIZE
4096

As per Oracle SHMALL should be set to the total amount of physical RAM divided by page size.

Our system has 64GB memory, so change kernel.shmall = 1024 * 1024 * 1024 * 64 / 4096 = 16777216


Once this value is calculated you can modify Linux system configuration file directly.

$ su - root
vi /etc/sysctl.conf file:
kernel.shmall=16777216

and

# sysctl -p

Once this is done the database was started without any problem.
10 comments
Read more