Bug 499867 - (CVE-2009-1523, CVE-2009-1524) CVE-2009-1523 CVE-2009-1524: multiple vulnerabilities in jetty
CVE-2009-1523 CVE-2009-1524: multiple vulnerabilities in jetty
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://web.nvd.nist.gov/view/vuln/det...
impact=moderate,source=vendor-sec,rep...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-05-08 12:10 EDT by Vincent Danen
Modified: 2009-08-26 17:39 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-08-26 17:39:05 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
upstream patch to fix CVE-2009-1523 in jetty 6.x (3.85 KB, patch)
2009-05-08 12:15 EDT, Vincent Danen
no flags Details | Diff
Proposed patch for jetty 5.1.14. (3.47 KB, patch)
2009-05-13 16:15 EDT, Jeff Johnston
no flags Details | Diff
Proposed patch for jetty 5.1.14. (3.49 KB, patch)
2009-05-13 16:51 EDT, Jeff Johnston
no flags Details | Diff

  None (edit)
Description Vincent Danen 2009-05-08 12:10:38 EDT
Common Vulnerabilities and Exposures assigned the identifiers CVE-2009-1523
and CVE-2009-1524 to the following vulnerabilities:

Name: CVE-2009-1523
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1523
Assigned: 20090505
Reference: CONFIRM: http://jira.codehaus.org/browse/JETTY-1004
Reference: CONFIRM: http://www.kb.cert.org/vuls/id/CRDY-7RKQCY
Reference: CERT-VN:VU#402580
Reference: URL: http://www.kb.cert.org/vuls/id/402580
Reference: BID:34800
Reference: URL: http://www.securityfocus.com/bid/34800
Reference: SECUNIA:34975
Reference: URL: http://secunia.com/advisories/34975

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty
before 6.1.17, and 7.0.0.M2 and earlier 7.x versions, allows remote
attackers to access arbitrary files via directory traversal sequences
in the URI.

Name: CVE-2009-1524
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1524
Assigned: 20090505
Reference: CONFIRM: http://jira.codehaus.org/browse/JETTY-980
Reference: BID:34800
Reference: URL: http://www.securityfocus.com/bid/34800
Reference: SECUNIA:34975
Reference: URL: http://secunia.com/advisories/34975

Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before
6.1.17 allows remote attackers to inject arbitrary web script or HTML
via a directory listing request containing a ; (semicolon) character.


Note: it is unclear whether or not this affects jetty 5.x, which is the version that is included in Fedora.
Comment 2 Vincent Danen 2009-05-08 12:15:29 EDT
Created attachment 343124 [details]
upstream patch to fix CVE-2009-1523 in jetty 6.x

Looking at the patch, I believe 5.x would be affected by this as well on a quick first glance.  I need to look at it a bit closer, but with some quick grepping, it looks like:

Response.java maps to servlet/ServletHttpResponse.java and possibly some duplicate code in servlet/Dispatcher.java.  The URIUtil.java maps to util/URI.java (thus changing all URIUtil.* functions to URI.*).
Comment 3 Jan Lieskovsky 2009-05-13 07:58:16 EDT
For CVE-2009-1524:

Upstream issue description is here:
http://jira.codehaus.org/browse/JETTY-980

According to comment from:
http://jira.codehaus.org/browse/JETTY-980?focusedCommentId=174717&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#action_174717

patch from:
http://jira.codehaus.org/secure/attachment/41486/JETTY-980.patch

is not needed and patch for:
http://jira.codehaus.org/browse/JETTY-1004

sufficient to fix this issue (otherwise relevant file affected by this
issue in jetty-5.1.14 is jetty-5.1.14/src/org/mortbay/util/Resource.java).

Provided PoC from http://jira.codehaus.org/browse/JETTY-980 (part "Description"
can be used for verification).

--

For CVE-2009-1523, the patch and file, which needs to be patched are
mentioned in previous comment.
Comment 4 Jeff Johnston 2009-05-13 16:15:05 EDT
Created attachment 343870 [details]
Proposed patch for jetty 5.1.14.
Comment 5 Jeff Johnston 2009-05-13 16:51:59 EDT
Created attachment 343874 [details]
Proposed patch for jetty 5.1.14.

Fixed patch.
Comment 6 Vincent Danen 2009-05-19 16:38:41 EDT
Jetty 5.1.15 has been released to correct the directory traversal issue (possibly the XSS issue, I'm awaiting confirmation on that since I can't seem to find a relevant CVS repository for Jetty 5.x):

http://dist.codehaus.org/jetty/jetty-5.1.x/
Comment 9 Vincent Danen 2009-05-22 15:26:40 EDT
CVE-2009-1523 was fixed in the upstream 5.1.15 release.  CVE-2009-1524 has not been confirmed in Jetty 5.x by upstream; if it does affect Jetty 5.x it is not fixed.

Upstream's mitigation solution for CVE-2009-1524 is to disable directory listings by setting dirAllowed to false in the webdefault.xml file, which we should do in Fedora since this should be only permitted by administrators as they need it, and not as a default anyways.
Comment 10 Fedora Update System 2009-05-22 15:27:09 EDT
jetty-5.1.15-3.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/jetty-5.1.15-3.fc9
Comment 11 Fedora Update System 2009-05-22 15:28:56 EDT
jetty-5.1.15-3.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/jetty-5.1.15-3.fc10
Comment 12 Fedora Update System 2009-05-22 15:58:56 EDT
jetty-5.1.15-4.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/jetty-5.1.15-4.fc11
Comment 13 Fedora Update System 2009-05-26 03:55:42 EDT
jetty-5.1.15-3.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2009-05-26 03:56:12 EDT
jetty-5.1.15-4.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Fedora Update System 2009-05-26 03:56:55 EDT
jetty-5.1.15-3.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.