Red Hat Bugzilla – Bug 670944
CVE-2008-7271 eclipse: Help Content web application vulnerable to multiple XSS flaws
Last modified: 2015-08-19 05:03:03 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7271 to the following vulnerability: Name: CVE-2008-7271 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7271 Assigned: 20110113 Reference: MISC: http://r00tin.blogspot.com/2008/04/eclipse-local-web-server-exploitation.html Reference: MISC: https://bugs.eclipse.org/bugs/show_bug.cgi?id=223539 Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via (1) the searchWord parameter to help/advanced/searchView.jsp or (2) the workingSet parameter in an add action to help/advanced/workingSetManager.jsp, a different issue than CVE-2010-4647.
Copying some relevant comments from bug #661901 (CVE-2010-4647, a similar bug): For CVE-2008-7271, these issues should be fixed in Eclipse 3.6, via: /help/advanced/searchView.jsp: Bug 223980 � [Webapp] Unencoded strings inserted into JavaScript http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/searchView.jsp?r1=1.31&r2=1.32 Bug 271049 - [Webapp][Security] XSS vulnerabilities in Eclipse 3.4 help system http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/searchView.jsp?r1=1.32&r2=1.32.2.1 /help/advanced/workingSetManager.jsp: Bug 223980 � [Webapp] Unencoded strings inserted into JavaScript http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/workingSetManager.jsp?r1=1.59&r2=1.60 Bug 271049 � [Webapp] XSS vulnerabilities in Eclipse 3.4 help system http://dev.eclipse.org/viewcvs/viewvc.cgi/org.eclipse.help.webapp/advanced/workingSetManager.jsp?r1=1.62&r2=1.63 So, for the question of whether CVE-2008-7271 is fixed in 3.6, the answer is yes. It looks like it was also fixed in 3.4, so RHEL6 would not have been affected by it; RHEL5 is though.
Lowering the impact due to the fact that you must have Eclipse running at the time you visit a malicious web site. Also, the web server that serves up the help contents randomizes the port number each time it starts, so the malicious site needs to guess what port it is listening on (i.e. first run here was on port 52621, second run on 50193).
Statement: (none)