Jetty fails to properly process URLs that contain double / characters

Overview

The Jetty web server contains a vulnerability that may allow an attacker to access private files or directories.

Description

Jetty is a web server that is implemented in Java. Jetty contains a vulnerability in the way it processes URLs with multiple “/” (slash) characters. See the Jetty Double slash problem bug report for more information.

---

Impact

A remote unauthenticated attacker may be able view hidden or private files and directories.

---

Solution

Upgrade

Jetty version 6.1.7 has been released to address this issue.

---

Filter URLs

Until updates can be applied, administrators may be able to use an application firewall or reverse proxy server to filter “//” characters in URLs.

---

Vendor Information

553235

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Mort Bay __ Affected

Updated: January 03, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

See <http://jira.codehaus.org/browse/JETTY-386#action_117699&gt; for more information.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23553235 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://jira.codehaus.org/browse/JETTY-386#action_117699&gt;
• <http://jira.codehaus.org/browse/JETTY/fixforversion/13950&gt;
• <http://www.visolve.com/squid/squid24s1/access_controls.php&gt;
• <http://httpd.apache.org/docs/1.3/mod/mod_proxy.html&gt;
• <http://secunia.com/advisories/28322/&gt;

Acknowledgements

Thanks to Greg Wilkins for reporting this vulnerability and for providing information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

CVE IDs:	CVE-2007-6672
Severity Metric:	2.64 Date Public: