HTTP TRACE / TRACK method vulnerability (CVE-2003-1567, CVE-2004-2320, CVE-2010-0386)

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:
Vulnerability scans might report the HTTP TRACE method on vCenter ports 9084 and 9087 as vulnerable.

Environment

VMware vCenter Server 8.0.1
VMware vCenter Server 8.0.0
VMware vCenter Server 7.0.3

Resolution

For 7.0, the issue has been resolved in 7.0 U3o.

For 8.0, the issue has been resolved in 8.0U2. 

Workaround:
Connect to vCenter through SSH and run the following steps:

1. Backup all the *.war files before editing them.
2.  mkdir /tmp/war/
3. cp /usr/lib/vmware-updatemgr/bin/jetty/webapps/root.war /tmp/war/
4. cd /tmp/war/
5. unzip root.war
6. cd WEB-INF/
7. chmod 777 web.xml
8. edit web.xml and ADD the below piece of code after <servlet-mapping>:

   <security-constraint>
      <web-resource-collection>
      <web-resource-name>Restricted HTTP Methods</web-resource-name>
      <url-pattern>/*</url-pattern>
      <http-method>OPTIONS</http-method>
      <http-method>TRACE</http-method>
      </web-resource-collection>
      <auth-constraint />
   </security-constraint>

       9. cd ..
      10. zip -r -u root.war WEB-INF/
      11. cp root.war /usr/lib/vmware-updatemgr/bin/jetty/webapps/
      12. Clean /tmp/war with rm -rf /tmp/war/*
      13. Repeat steps 3 to 12 for vum-filedownload.war and vum-fileupload.war
      14. Restart updatemgr service using service-control --restart vmware-updatemgr

Additional Information

Impact/Risks:
Some third-party tools for vulnerability scans might report the HTTP TRACE method on vCenter ports 9084 and 9087 as vulnerable.