Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It was not until recently that I began to question the use for the Server field in the HTTP Response-Header.

I did some research:

RFC 2616 states:

14.38 Server

The Server response-header field contains information about the software used by the origin server to handle the request. The field can contain multiple product tokens (section 3.8) and comments identifying the server and any significant subproducts. The product tokens are listed in order of their significance for identifying the application.

   Server         = "Server" ":" 1*( product | comment )

Example:

   Server: CERN/3.0 libwww/2.17

If the response is being forwarded through a proxy, the proxy application MUST NOT modify the Server response-header. Instead, it SHOULD include a Via field (as described in section 14.45).

  Note: Revealing the specific software version of the server might
  allow the server machine to become more vulnerable to attacks
  against software that is known to contain security holes. Server
  implementors are encouraged to make this field a configurable

This, however, makes no mention of the purpose of this field. This seems like information disclosure to me. These server strings give away a lot of information that is great for anyone trying to fingerprint the server. Automated scanning tools would quickly identify unpatched or vulnerable servers. Having my web server present version information for itself and modules like OpenSSL seems like a bad idea.

  • Is this field needed... for anything? If so, what?
  • Is it already best practice / common place to disable or change this field on servers?

I would think that, from a security perspective, we would want to give the enemy (ie: Everyone) as little information as possible while still allowing business to continue. Here is an interesting write-up on information warfare.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

The server filed should be removed, and its an insecure default to have to present.

Its probably most useful for the Netcraft Web Server Survey. But in terms of HTTP it shouldn't matter. That is why we have standards so that clients and server written by different vendors can work together.

share|improve this answer
2  
This was my thinking as well. –  ZnArK Oct 26 '12 at 18:11
4  
Insecure might be a bit much. Its a form of information disclosure, but that alone doesn't make it insecure because there is no definition of secure. –  Steve Oct 26 '12 at 22:06
2  
@SteveS information disclosure vulnerabilities are a low finding and are on nearly every penetration test report I write because it is default. This is also a CWE violation. –  Rook Oct 26 '12 at 22:46

It's used for whatever you want to use it for. I've found it helpful in the past for reverse-engineering compliance issues; e.g. IIS breaks HTTP/1.1 (RFC 2616) in lots of ways, but most are to the benefit of the user in terms of performance and supported by most browsers. Actually most current browsers no longer comply with the rules in RFC 2616 (now 13 years old).

I've run into problems with bugs in HTTP server code and configuration in the past. Knowing what is running at the remote end is a great help to diagnosing and resolving these problems.

Yes, in Security 101 you're told that obscuring this kind of information improves security, IME the benefits are limited:

  • Script kiddies/automated attacks don't bother looking to see what software you are running - they just fire all their guns and hope for the best.

  • Anyone who is reasonably competent should be able to determine the server type (although I've not tried this with HTTP servers, a few years ago, I was conducting a survey of SMTP servers - with an average of 2.1 commands, I could find the type and take a good guess at the major version number of MTAs from 12 different vendors).

share|improve this answer
    
Great Answer, although, is there any benefit to exposing this information to the Internet? (public facing web applications) –  ZnArK Oct 30 '12 at 6:28
1  
The benefit is the debugging thing - I do a lot of development work on web services / automation - not every client is a browser with a user driving it. –  symcbean Oct 30 '12 at 9:55
    
I could see a use for this in a development environment, but not on internet facing production systems. What benefit does it really provide to an organization to expose this information to the internet? –  ZnArK Oct 31 '12 at 3:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.