Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2007.0975 -- [Win][UNIX/Linux]
Multiple Vulnerabilities in Mortbay Jetty
5 December 2007
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Mortbay Jetty
Publisher: US-CERT
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact: Cross-site Scripting
Inappropriate Access
Denial of Service
Access: Remote/Unauthenticated
CVE Names: CVE-2007-5615 CVE-2007-5614 CVE-2007-5613
Original Bulletin: http://www.kb.cert.org/vuls/id/212984
http://www.kb.cert.org/vuls/id/438616
http://www.kb.cert.org/vuls/id/237888
Comment: This bulletin contains three (3) US-CERT security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
US-CERT Vulnerability Note VU#212984
Mortbay Jetty vulnerable to HTTP response splitting
Overview
Mortbay Jetty is vulnerable to HTTP response splitting, which may
allow a remote, unauthenticated attacker to inject various HTTP
headers.
I. Description
Mortbay Jetty is a web server that is written in Java. Jetty fails
to properly handle HTTP headers with CRLF sequences, which can
allow an attacker to inject certain HTTP headers into server
responses.
II. Impact
A remote, unauthenticated attacker may be able to perform a
cross-site scripting attack, set cookies, or poison a proxy cache.
III. Solution
Apply an update
This issue is addressed in Mortbay Jetty 6.1.6 [2]. Details are
available in the release notes [1].
Systems Affected
Vendor Status Date Updated
Mort Bay Vulnerable 4-Dec-2007
References
[1] http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
[2] http://dist.codehaus.org/jetty/jetty-6.1.6/
Credit
Thanks to Tomasz Kuczynski for reporting this vulnerability.
This document was written by Will Dormann.
Other Information
Date Public 03/11/2007
Date First Published 04/12/2007 13:21:11
Date Last Updated 03/12/2007
CERT Advisory
CVE Name CVE-2007-5615
Metric 4.41
Document Revision 3
US-CERT Vulnerability Note VU#438616
Mortbay Jetty fails to properly handle cookies with quotes
Overview
Mortbay Jetty fails to properly handle cookie quotes, which may
allow session hijacking.
I. Description
Mortbay Jetty is a web server that is written in Java. Jetty fails
to properly handle cookies with certain quote sequences. This can
cause the Jetty cookie parsing mechanism to improperly handle all
of the cookies in the cookie string that follow the cookie with
the quote sequence.
II. Impact
This vulnerability can increase the possibility of a session
hijacking success. In the presense of a cross-site scripting
vulnerability, it may allow a denial-of-service attack against a
web site by preventing a client from being able to log in using
cookies.
III. Solution
Apply an update
This issue is addressed in Mortbay Jetty 6.1.6 [2]. Details are
available in the release notes [1].
Systems Affected
Vendor Status Date Updated
Mort Bay Vulnerable 4-Dec-2007
References
[1] http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
[2] http://dist.codehaus.org/jetty/jetty-6.1.6/
Credit
Thanks to Tomasz Kuczynski for reporting this vulnerability.
This document was written by Will Dormann.
Other Information
Date Public 05/11/2007
Date First Published 04/12/2007 13:05:14
Date Last Updated 03/12/2007
CERT Advisory
CVE Name CVE-2007-5614
Metric 2.78
Document Revision 4
US-CERT Vulnerability Note VU#237888
Mortbay Jetty Dump Servlet vulnerable to cross-site scripting
Overview
The Mortbay Jetty Dump Servlet contains a cross-site scripting
vulnerability.
I. Description
Mortbay Jetty is a web server that is written in Java. The Dump
Servlet that is included with Jetty is vulnerable to cross-site
scripting. Note that according to the vendor, the Dump Servlet is
for testing purposes and is not intended to be included in a live
web site.
II. Impact
A remote, unauthenticated attacker may be able to perform a
cross-site scripting attack against a Jetty web server. More
information about cross-site scripting can be found in CERT
Advisory CA-2000-02.
III. Solution
Apply an update
This issue is addressed in Mortbay Jetty 6.1.6 [3]. Details are
available in the release notes [1].
Remove the Dump Servlet
This issue can be mitigated by removing the Dump Servlet from the
web server.
Systems Affected
Vendor Status Date Updated
Mort Bay Vulnerable 4-Dec-2007
References
[1] http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
[2] http://jira.codehaus.org/browse/JETTY-452
[3] http://dist.codehaus.org/jetty/jetty-6.1.6/
Credit
Thanks to Tomasz Kuczynski for reporting this vulnerability.
This document was written by Will Dormann.
Other Information
Date Public 05/11/2007
Date First Published 04/12/2007 12:40:07
Date Last Updated 03/12/2007
CERT Advisory
CVE Name CVE-2007-5613
Metric 3.29
Document Revision 7
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBR1YUvih9+71yA2DNAQJCdgP8C5agYbzKAZGYYVBet+zMR5dCafAwERWf
NM+mJW+dgqBrXRBTBhnnEsTzAHouv9iDye3L4evTErrRU2B9cdtwPBvkNk8uiNfG
8/5cx9F4jIom/hXWcvn5sQDFQ9nPjV4bgFyviWMa4lGJrOBjBRm38Z4rXr31Pkv6
RnaFd4bb6NA=
=xK2b
-----END PGP SIGNATURE-----