Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.

Websphere has been updated to version 2.1.0.1 to fix several security vulnerabilities in the included subprojects, such as Apache Geronimo and Tomcat. (CVE-2007-0184 / CVE-2007-0185 / CVE-2007-2377 / CVE-2007-2449 / CVE-2007-2450 / CVE-2007-3382 / CVE-2007-3385 / CVE-2007-3386 / CVE-2007-5333 / CVE-2007-5342 / CVE-2007-5461 / CVE-2007-5613 / CVE-2007-5615 / CVE-2007-6286 / CVE-2008-0002 / CVE-2008-1232 / CVE-2008-1947 / CVE-2008-2370 / CVE-2008-2938)

- Fri Jul 4 2008 Jeff Johnston <jjohnstn at redhat.com>     5.1.14-1jpp.1

    - Security patch

    - Resolves #417401, #417411, #417391

    - Upgrade to 5.1.14 source tarball for Fedora

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #417411 - CVE-2007-5615: jetty CRLF injection

  - Bug #417391 - CVE-2007-5613: jetty cross site scripting

  - Bug #417401 - CVE-2007-5614: jetty session hijacking     issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.

Mortbay Jetty before 6.1.6rc1 does not properly handle 'certain quote sequences' in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

The remote instance of Mort Bay Jetty includes a test servlet, 'webapps/test/jsp/dump.jsp', that fails to sanitize user-supplied input before using it to generate dynamic content.  An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site. 

Similar issues reportedly exist with the 'webapps/snoop.jsp'' servlet as well as Jetty itself, although Nessus did not check for them.

The remote host is running Jetty, a Java web server that can be downloaded off the Internet and is currently bundled with some IBM applications.  This version of Jetty is vulnerable to a remote flaw in the way that it handles cookie quotes.  An attacker exploiting this flaw would be able to hijack the session of valid users without authentication.  Further, this version of Jetty is vulnerable to a flaw in the way that it handles Carriage-Return/Line-Feed characters.  An attacker can exploit this flaw to inject malicious HTTP headers into a session.  This version of Jetty is also vulnerable to a cross-site scripting (XSS) attack that would allow an attacker to possibly retrieve sensitive data from client browsers.

ID	Name	Product	Family	Severity
41596	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 5850)	Nessus	SuSE Local Security Checks	high
33418	Fedora 8 : jetty-5.1.14-1jpp.1.fc8 (2008-6164)	Nessus	Fedora Local Security Checks	high
33417	Fedora 9 : jetty-5.1.14-1jpp.2.fc9 (2008-6141)	Nessus	Fedora Local Security Checks	high
29288	FreeBSD : jetty -- multiple vulnerabilities (6ae7cef2-a6ae-11dc-95e6-000c29c5647f)	Nessus	FreeBSD Local Security Checks	high
29219	Mort Bay Jetty Dump Servlet (webapps/test/jsp/dump.jsp) XSS	Nessus	CGI abuses : XSS	medium
4307	Jetty < 6.1.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2007-5613

medium

Tenable Plugins

high

high

high

high

medium

medium