I have seen in many places that people say that headers of the following types is a vulnerability:
Server:Microsoft-IIS/7.5 X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET
I can see that this gives the attacker additional information so that he can verify the known bugs on these platforms and then abuse them. But it seems to me that removing these headers can only protect you against very simple script kiddies and any serious attacks would uncover this information rather easily. E.g.
- There has to be a way in which IIS responds differently or fails differently when intricate random garbage is sent to it compared to other servers
- A list of known vulnerabilities in ASP.NET can be tried one by one to see if any apply + the same point as above applies to ASP.NET itself
- Some other similar manipulations
So all in all it seems that any serious adversary would really be able to uncover that information rather simply.
And after all will removing the headers give you any benefits apart from very simple protection from script kiddies who will first target the sites that have the vulnerability like in a popular quote:
“You don’t have to run faster than the bear to get away. You just have to run faster than the guy next to you.”
P.S. You probably have much more serious issues if this information disclosure can lead to a real vulnerability.
P.P.S. There is no point to have this headers anyway since it will even benefit performance (quite negligibly though), so it's a good idea to get rid of them, but I am still curious about the whole "security" argument here