R_ReVo
asked on
IP address is revealed in the content-location field in the TCP header in IIS 6.0
We have recently undergone a network vulnerability scan and we were told that an IP address is revealed in the content-location field in the TCP header in IIS 6.0 on one of our MS 2003 (Standard - SP1) Servers. Unfortunitely it is the server that is running Exchange 2003 (SP2) with OWA. I tried changing the SetHostName and the UseHostName properties as described in Microsofts KB Article 834141, but when I change either of these two properties I am unable to access my OWA (page can not be displayed). Does anyone have a fix/workaround as to not allow an IP address to be revealed in the content-location field in the TCP header and allow OWA to function properly?
denlight2
06.24.2008 at 06:04PM CDT, ID: 21861382
Well it turns out I can answer my own question. I was able to pass a PCI scan and fix the HTTP Header vulnerability by leaving UseHostName = false and setting SetHoseName = network.(domain).com. Where that subdomain is the domain used to access RWW.
I'm sticking with my solution of disabling form authentication to resolve the URL injection issue.
denlight2
06.24.2008 at 06:04PM CDT, ID: 21861382
Well it turns out I can answer my own question. I was able to pass a PCI scan and fix the HTTP Header vulnerability by leaving UseHostName = false and setting SetHoseName = network.(domain).com. Where that subdomain is the domain used to access RWW.
I'm sticking with my solution of disabling form authentication to resolve the URL injection issue.
Last Comment
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
Exchange
Exchange is the server side of a collaborative application product that is part of the Microsoft Server infrastructure. Exchange's major features include email, calendaring, contacts and tasks, support for mobile and web-based access to information, and support for data storage.
213K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
ASKER
(I was unable to connect to OWA externally, when I changed the SetHostName or UseHostName properties.)
But... I just set SetHostName to the same as the external domain name and our OWA appears to be functioning properly externally. (THANKS!) I am going to schedule another network vulnerability scan tonight and say my prayers.... Thanks again.