Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.

The version of Apache Hadoop running on the remote host has a cross- site scripting vulnerability.  This is due to a bug in Jetty, the underlying web server.  When Jetty displays a directory listing, arbitrary text can be inserted into the page.  This affects all Hadoop components that use the Jetty web server.

A remote attacker could exploit this by tricking a user into making a maliciously crafted request, resulting in the execution of arbitrary script code.

It is likely this version of Hadoop has other security vulnerabilities, though Nessus did not check for those issues.

The version of VMware vCenter Update Manager installed on the remote Windows host is 4.0 earlier than Update 3 or 4.1 earlier than Update 1. The installed version is, therefore, potentially affected by multiple vulnerabilities in the embedded Jetty Web server :

  - A directory traversal vulnerability allows a remote,     unauthenticated attacker to obtain files from the     remote host. (CVE-2009-1523)

  - A cross-site scripting vulnerability allows a remote     attacker to execute arbitrary script code in the user's     browser. (CVE-2009-1524)

The version of VMware vCenter Update Manager running on the remote host has a cross-site scripting vulnerability.  This is due to a bug in Jetty, the underlying web server.  When Jetty displays a directory listing, arbitrary text can be inserted into the page.

A remote attacker could exploit this by tricking a user into making a maliciously crafted request, resulting in the execution of arbitrary script code.

It is likely this version of Update Manager also has a directory traversal vulnerability, though Nessus did not check for that issue.

This bug upgrades jetty to 5.1.15 which addresses CVE-2009-1523. * Wed Feb 11 2009 Jeff Johnston <jjohnstn at redhat.com> 5.1.14-1.10 - Rename jettyc back to .jettyrc. - Resolves #485012 * Tue Feb 03 2009 Jeff Johnston <jjohnstn at redhat.com> 5.1.14-1.9 - Change %%{_sysconfdir}/init.d references to be %%{_initrddir} - Resolves #473585 * Mon Feb 02 2009 Jeff Johnston <jjohnstn at redhat.com> 5.1.14-1.8 - Fixes for unowned directories.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This build upgrades jetty to 5.1.15 which addresses CVE-2009-1523.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This build upgrades jetty to 5.1.15 which addresses CVE-2009-1523

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote instance of Mort Bay Jetty is vulnerable to a number of flaws.  First, the application is vulnerable to a cross-site-scripting flaw when displaying web directory listings.  Secondly, the application is prone to an information disclosure flaw which can be used to read files outside the web root.  Note:  in order for the second flaw to be executed, Jetty must have been configured to have DefaultServlet with support for aliases turned on.

ID	Name	Product	Family	Severity
55975	Apache Hadoop Jetty XSS	Nessus	CGI abuses : XSS	medium
52014	VMSA-2010-0012 : VMware vCenter Update Manager Fix for Jetty Web Server	Nessus	Windows	medium
47897	VMware vCenter Update Manager XSS	Nessus	CGI abuses : XSS	medium
38919	Fedora 10 : jetty-5.1.15-3.fc10 (2009-5513)	Nessus	Fedora Local Security Checks	medium
38918	Fedora 11 : jetty-5.1.15-4.fc11 (2009-5509)	Nessus	Fedora Local Security Checks	medium
38917	Fedora 9 : jetty-5.1.15-3.fc9 (2009-5500)	Nessus	Fedora Local Security Checks	medium
5017	Mort Bay Jetty < 6.1.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2009-1524

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium