Re: Deny Put Delete

2014-01-26 Thread Mark Eggers
On 1/25/2014 9:32 PM, Vicky B wrote: if I have a privilege to ask a question on this topic if can anyone help me on how an user fire a put request or delete request ( I am not a hacker) .All my life I just used post and get I never thought about these put and delete, so if someone helps I would

Re: Deny Put Delete

2014-01-26 Thread Neven Cvetkovic
On Sun, Jan 26, 2014 at 12:32 AM, Vicky B vickyb2...@gmail.com wrote: if I have a privilege to ask a question on this topic if can anyone help me on how an user fire a put request or delete request ( I am not a hacker) .All my life I just used post and get I never thought about these put and

Re: Deny Put Delete

2014-01-26 Thread Vicky B
Thanks neven,mark On Sun, Jan 26, 2014 at 4:00 PM, Neven Cvetkovic neven.cvetko...@gmail.comwrote: On Sun, Jan 26, 2014 at 12:32 AM, Vicky B vickyb2...@gmail.com wrote: if I have a privilege to ask a question on this topic if can anyone help me on how an user fire a put request or delete

Re: Deny Put Delete

2014-01-25 Thread Vicky B
if I have a privilege to ask a question on this topic if can anyone help me on how an user fire a put request or delete request ( I am not a hacker) .All my life I just used post and get I never thought about these put and delete, so if someone helps I would appreciate On Fri, Jan 24, 2014 at

Re: Deny Put Delete

2014-01-24 Thread Johan Compagner
I've dealt with similar nonsensical compliance scans before, and my response was: You believe you can PUT or DELETE files on this installation? ** makes popcorn ** Please proceed. I'll sit here and watch. Take your time. Morons. Bane of productive peoples' existence. Also, a special

Deny Put Delete

2014-01-23 Thread Stephan Fletcher
Can anyone tell me how to fix the following in my Tomcat config. I'm using Apache Tomcat 7.0.30 and I'm failing on the following PCI Security scans. 1. Title: Web server allows PUT: / Impact: An attacker may be able to upload files onto the web server. Data Received: Allow: GET, HEAD,

Re: Deny Put Delete

2014-01-23 Thread Mark Thomas
On 23/01/2014 14:57, Stephan Fletcher wrote: Any help would be greatly appreciated rant Buy a better vulnerability scanner. Specifically, one understands that an OPTIONS request returns the methods that are *available* not the methods that are *permitted*. /rant Assuming you haven't changed

RE: Deny Put Delete

2014-01-23 Thread Stephan Fletcher
It's a third party that is running the scan. -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Thursday, January 23, 2014 10:05 AM To: Tomcat Users List Subject: Re: Deny Put Delete On 23/01/2014 14:57, Stephan Fletcher wrote: Any help would be greatly appreciated

Re: Deny Put Delete

2014-01-23 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Stephan, On 1/23/14, 9:57 AM, Stephan Fletcher wrote: Can anyone tell me how to fix the following in my Tomcat config. I'm using Apache Tomcat 7.0.30 and I'm failing on the following PCI Security scans. 1. Title: Web server allows PUT:

Re: Deny Put Delete

2014-01-23 Thread Christopher Schultz
, but probably not. - -chris -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Thursday, January 23, 2014 10:05 AM To: Tomcat Users List Subject: Re: Deny Put Delete On 23/01/2014 14:57, Stephan Fletcher wrote: Any help would be greatly appreciated rant Buy a better

Re: Deny Put Delete

2014-01-23 Thread Hassan Schroeder
On Thu, Jan 23, 2014 at 7:09 AM, Stephan Fletcher sfletc...@bohrensmoving.com wrote: It's a third party that is running the scan. I've dealt with similar nonsensical compliance scans before, and my response was: You believe you can PUT or DELETE files on this installation? ** makes popcorn **

Re: Deny Put Delete

2014-01-23 Thread André Warnier
: Thursday, January 23, 2014 10:05 AM To: Tomcat Users List Subject: Re: Deny Put Delete On 23/01/2014 14:57, Stephan Fletcher wrote: Any help would be greatly appreciated rant Buy a better vulnerability scanner. Specifically, one understands that an OPTIONS request returns the methods

Re: Deny Put Delete

2014-01-23 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hassan, On 1/23/14, 11:08 AM, Hassan Schroeder wrote: On Thu, Jan 23, 2014 at 7:09 AM, Stephan Fletcher sfletc...@bohrensmoving.com wrote: It's a third party that is running the scan. I've dealt with similar nonsensical compliance scans