05-12-2015 04:09 PM
Security team has informed to me about this warning "Apache HTTP Server httpOnly Cookie Information Disclosure"
Interface web disable
Could someone tell me how to fix it?? Should I do an upgrade?? which version?
PD: I thing I could be a false positive
05-21-2015 06:26 PM
I see often that so called "security experts" run a network-wide scan and then throw all these sorts of messages at the respective departements.
They should provide more information like which http daemon (apache,nginx,iis etc) is susceptible including the versions affected and which version does include the fix.
There have been a fair number of FOS upgrades related to bash and http security issues and these have been resolved in subsequent fos upgrades. if you run 6.4.3e or 7.3.1a you should be OK.
If you know which software package is susceptible you can check here for the specific package and see if it has been resolved in newer FOS releases.
06-04-2015 04:41 PM
Thanks for your reply!
But I do not understand why we get this messages. We have blocked(via ipfilter) the http accesss (ṕort 80). To avoid this message should we block the port 443 too?? I mean via IPfilter???
06-10-2015 08:08 PM
Yes, obviously the same Cookie Disclosure information is available via the ssl port. Fence this off and you should be good to go unless your ruleset doesn't take you network configuration into account. I assume that the security guys have multiple entries into the network and therefor may be able to bypass your rules. Anyway, you shold check with them first.
As I'm a huge opponent to these very bad workarounds you should grab the bull by the horns and fix the underlying issue. Investigate if the security problem is fixed in newer code-levels and upgrade to that. This way you don't have to keep track of all these bypasses and workarounds. I've seen issues like this where switches became totally unmanageble when the network guys decided to do some re-designing of their subnets. Their SAN kit was stuck in a black-hole and they needed to send someone 800 miles furtherup to reconfigure the switches. expensive exersize.