Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to     trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU     consumption) by sending many crafted parameters. (CVE-2011-4461)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to
    trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU
    consumption) by sending many crafted parameters. (CVE-2011-4461)

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by vulnerabilities in the following subcomponents of the Enterprise Manager Base Platform component :

  - Agent
  - UI Framework
  - Process Management & Notification

Note that the product was formerly known as the Enterprise Manager Grid Control.

jetty5 was prone to a remotely exploitable Denial of Service flaw via hash collisions (CVE-2011-4461).

jetty5 was prone to a remotely exploitable Denial of Service flaw via hash collisions

It was discovered that Jetty computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. This could allow a remote attacker to cause a denial of service by sending many crafted parameters.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Back-port of upstream jetty patches for CVE-2011-4461, hash DOS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Back-port of upstream jetty patches for CVE-2011-4461 - hash table collisions DoS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
217525	Linux Distros Unpatched Vulnerability : CVE-2011-4461	Nessus	Misc.	Local	medium
418410	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-qxp4-27vx-xmm3)	Tenable Cloud Security	SCA Checks	Local	medium
418410	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-qxp4-27vx-xmm3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
80966	Oracle Enterprise Manager Cloud Control Multiple Vulnerabilities (January 2015 CPU)	Nessus	Misc.	Local	medium
75875	openSUSE Security Update : jetty5 (openSUSE-SU-2012:0262-1)	Nessus	SuSE Local Security Checks	Local	medium
74553	openSUSE Security Update : jetty5 (openSUSE-2012-128)	Nessus	SuSE Local Security Checks	Local	medium
58892	Ubuntu 10.04 LTS / 11.04 : jetty vulnerability (USN-1429-1)	Nessus	Ubuntu Local Security Checks	Local	medium
58462	Fedora 15 : jetty-6.1.26-7.fc15 (2012-0752)	Nessus	Fedora Local Security Checks	Local	medium
58461	Fedora 16 : jetty-6.1.26-8.fc16 (2012-0730)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2011-4461

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium