Bug 670944 (CVE-2008-7271)

Summary:	CVE-2008-7271 eclipse: Help Content web application vulnerable to multiple XSS flaws
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	alee, cfu, dpal, jmagne, jrusnack, mharmsen, patrickm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-06 11:59:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2011-01-19 18:18:34 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7271 to
the following vulnerability:

Name: CVE-2008-7271
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7271
Assigned: 20110113
Reference: MISC: http://r00tin.blogspot.com/2008/04/eclipse-local-web-server-exploitation.html
Reference: MISC: https://bugs.eclipse.org/bugs/show_bug.cgi?id=223539

Multiple cross-site scripting (XSS) vulnerabilities in the Help
Contents web application (aka the Help Server) in Eclipse IDE,
possibly 3.3.2, allow remote attackers to inject arbitrary web script
or HTML via (1) the searchWord parameter to
help/advanced/searchView.jsp or (2) the workingSet parameter in an add
action to help/advanced/workingSetManager.jsp, a different issue than
CVE-2010-4647.

Comment 1 Vincent Danen 2011-01-19 18:21:39 UTC

Copying some relevant comments from bug #661901 (CVE-2010-4647, a similar bug):

For CVE-2008-7271, these issues should be fixed in Eclipse 3.6, via:

/help/advanced/searchView.jsp:
  Bug 223980 � [Webapp] Unencoded strings inserted into JavaScript
 
http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/searchView.jsp?r1=1.31&r2=1.32

  Bug 271049 -  [Webapp][Security] XSS vulnerabilities in Eclipse 3.4 help
system
 
http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/searchView.jsp?r1=1.32&r2=1.32.2.1


/help/advanced/workingSetManager.jsp:
  Bug 223980 � [Webapp] Unencoded strings inserted into JavaScript
 
http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/workingSetManager.jsp?r1=1.59&r2=1.60

  Bug 271049 � [Webapp] XSS vulnerabilities in Eclipse 3.4 help system
 
http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/workingSetManager.jsp?r1=1.62&r2=1.63

So, for the question of whether CVE-2008-7271 is fixed in 3.6, the answer is
yes.  It looks like it was also fixed in 3.4, so RHEL6 would not have been
affected by it; RHEL5 is though.

Comment 2 Vincent Danen 2011-01-19 18:50:37 UTC

Lowering the impact due to the fact that you must have Eclipse running at the time you visit a malicious web site.  Also, the web server that serves up the help contents randomizes the port number each time it starts, so the malicious site needs to guess what port it is listening on (i.e. first run here was on port 52621, second run on 50193).

Comment 3 Vincent Danen 2011-01-19 18:52:22 UTC

Statement:

(none)