Vulnerability Note VU#553235

Jetty fails to properly process URLs that contain double / characters

Overview

The Jetty web server contains a vulnerability that may allow an attacker to access private files or directories.

I. Description

Jetty is a web server that is implemented in Java. Jetty contains a vulnerability in the way it processes URLs with multiple "/" (slash) characters. See the Jetty Double slash problem bug report for more information.

II. Impact

A remote unauthenticated attacker may be able view hidden or private files and directories.

III. Solution

Upgrade

Jetty version 6.1.7 has been released to address this issue.

Filter URLs

Until updates can be applied, administrators may be able to use an application firewall or reverse proxy server to filter "//" characters in URLs.

Systems Affected

Vendor	Status	Date Updated
Mort Bay	Vulnerable	3-Jan-2008

References

http://jira.codehaus.org/browse/JETTY-386#action_117699
http://jira.codehaus.org/browse/JETTY/fixforversion/13950
http://www.visolve.com/squid/squid24s1/access_controls.php
http://httpd.apache.org/docs/1.3/mod/mod_proxy.html
http://secunia.com/advisories/28322/

Credit

Thanks to Greg Wilkins for reporting this vulnerability and for providing information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public	12/28/2007
Date First Published	01/03/2008 10:07:35 AM
Date Last Updated	01/23/2008
CERT Advisory
CVE Name	CVE-2007-6672
US-CERT Technical Alerts
Metric	2.64
Document Revision	19

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader