SCG WS Apache

Summary
The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, featureful, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project. This file is intended to briefly describe the history of the Apache HTTP Server and recognize the many contributors.

Description
By Default Apache ServerToken directive revelas the below information. Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 This allows attackers to identify webservers details greatly and increases the effieciency of any attack,as security vulnerabilities are dependent upon specific software versions.

How to test
In order to test for ServerToken configuration, one should check the apache configuration file.

Misconfiguration
ServerTokens Full

Remediation
Configure the ServerTokens directive in the apache configurattion to value of Prod or ProductOnly ServerTokens Prod or ServerTokens ProductOnly