Although the HTTP TRACE capability isn't a security vulnerability per se, it can be leveraged by attackers to obtain sensitive information:

http://www.kb.cert.org/vuls/id/867593

Apache httpd 1.3.34, 2.0.55 and later include a "TraceEnable" directive that can be used to disable support for HTTP TRACE:

http://httpd.apache.org/docs/2.2/mod/core.html#traceenable

Per RFC2616, support for HTTP TRACE is OPTIONAL:

http://tools.ietf.org/html/rfc2616#section-5.1.1

Therefore, I will make the following assertion: HTTP TRACE should be disabled by default in Apache httpd. Most people don't need this functionality, and the people who do can always explicitly enable it.

However, Apache httpd currently takes the opposite approach: if not overridden in httpd.conf, the default value for TraceEnable is "on". Furthermore, the stock httpd.conf file does not set TraceEnable off.

I think we should try to convince upstream that the default value for TraceEnable should be "off". Furthermore, in the meantime, I think we should patch the stock httpd.conf file as contributed by the httpd RPM to include a "TraceEnable off" line (with a comment explaining the implications of enabling it).

I've filed this bug against Fedora Rawhide, but it applies to all actively supported Red Hat and Fedora releases which include a version of httpd that understands the TraceEnable directive (F8, F9, RHEL5). For supported releases which include a version of httpd that doesn't understand the TraceEnable directive (RHEL2.1, RHEL3, RHEL4), support for TraceEnable should be backported.