Vulnerability Note VU#553235

Jetty fails to properly process URLs that contain double / characters

Overview

The Jetty web server contains a vulnerability that may allow an attacker to access private files or directories.

I. Description

Jetty is a web server that is implemented in Java. Jetty contains a vulnerability in the way it processes URLs with multiple "/" (slash) characters. See the Jetty Double slash problem bug report for more information.

II. Impact

A remote unauthenticated attacker may be able view hidden or private files and directories.

III. Solution

Upgrade

Jetty version 6.1.7 has been released to address this issue.

Filter URLs

Until updates can be applied, administrators may be able to use an application firewall or reverse proxy server to filter "//" characters in URLs.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Mort Bay	Vulnerable	3-Jan-2008

References

http://jira.codehaus.org/browse/JETTY-386#action_117699
http://jira.codehaus.org/browse/JETTY/fixforversion/13950
http://www.visolve.com/squid/squid24s1/access_controls.php
http://httpd.apache.org/docs/1.3/mod/mod_proxy.html
http://secunia.com/advisories/28322/

Credit

Thanks to Greg Wilkins for reporting this vulnerability and for providing information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public:	2007-12-28
Date First Published:	2008-01-03
Date Last Updated:	2008-01-23
CERT Advisory:
CVE-ID(s):	CVE-2007-6672
NVD-ID(s):	CVE-2007-6672
US-CERT Technical Alerts:
Metric:	2.64
Document Revision:	19

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader