Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) help/index.jsp or (2) help/advanced/content.jsp.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - eclipse: Help Content web application vulnerable to multiple XSS (CVE-2010-4647)

  - Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help     Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via     (1) the searchWord parameter to help/advanced/searchView.jsp or (2) the workingSet parameter in an add     action to help/advanced/workingSetManager.jsp, a different issue than CVE-2010-4647. (CVE-2008-7271)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0568 advisory.

    eclipse:
    [1:3.6.1-6.13]
    - Drop patch to remove ant-trax (needed by test runs).

    [1:3.6.1-6.12]
    - Add two upstream patches to allow for running SDK JUnit tests.

    [1:3.6.1-6.11]
    - Bring in line with Fedora.
    - Remove some stuff that is now done in eclipse-build.
    - Fix sources URL.
    - Add PDE dependency on zip for pdebuild script.
    - Use new eclipse-build targets.
    - Increase minimum required memory in eclipse.ini.

    [1:3.6.1-6.10]
    - Put ant.launching into JDT's dropins directory.

    [1:3.6.1-6.9]
    - Use apache-tomcat-apis JARs.
    - Version objectweb-asm BR/R.

    [1:3.6.1-6.8]
    - Fix JSP API symlinks.

    [1:3.6.1-6.7]
    - Install o.e.jdt.junit.core in jdt (rhbz#663207).

    [1:3.6.1-6]
    - Add Eclipse help XSS vulnerability fix (RH Bz #661901).

    [1:3.6.1-5]
    - Remove work around for openjdk bug#647737 as openjdk has       posted its own work around and will shortly be fixing problem       correctly.

    [1:3.6.1-4]
    - Work around for openjdk bug#647737.

    [1:3.6.1-3]
    - Add missing Requires on tomcat5-jsp-api (bug#650145).

    [1:3.6.1-2]
    - Add prepare-build-dir.sh patch.

    [1:3.6.1-1]
    - Update to 3.6.1.

    [1:3.6.0-3]
    - Increasing min versions for jetty, icu4j-eclipse and sat4j.

    [1:3.6.0-2]
    - o.e.core.net.linux is no longer x86 only.

    [1:3.6.0-1]
    - Update to 3.6.0.
    - Based on eclipse-build 0.6.1 RC0.

    [1:3.5.2-10]
    - Rebuild for new jetty.

    [1:3.5.2-9]
    - Fix typo in symlinking.

    [1:3.5.2-8]
    - No need to link jasper.

    [1:3.5.2-7]
    - Fix servlet and jsp apis symlinks.

    [1:3.5.2-6]
    - Fix jetty symlinks.

    eclipse-birt:

    [2.6.0-1.1]
    - RHEL 6.1 rebase to Helios.

    [2.6.0-1]
    - Update to 2.6.0.
    - Build rhino plugin as part of BIRT chart feature.
    - Remove unnecessary dependencies.

    eclipse-callgraph:

    [0.6.1-1]
    - Update to upstream 0.6.1 release.
    - Add reasonable required dependency versions.

    [0.6.0-2]
    - Update tag to correct version

    [0.6.0-1]
    - Update to version 0.6 of Linux Tools Proect.

    [0.5.0-1]
    - Resolves: #575108
    - Rebase to Linux tools 0.5 release.

    [0.4.0-2]
    - Resolves: #553288
    - Only support i686, x86_64 for RHEL6 and above.

    [0.4.0-1]
    - Update to version 0.4 of Linux Tools Project and remove tests feature

    [0.0.1-3]
    - Added ExcludeArch for ppc64 because eclipse-cdt is not present

    [0.0.1-2]
    - Some more changes to spec file

    [0.0.1-1]
    - Make minor changes to spec file

    [0.0.1-1]
    - Initial creation of eclipse-callgraph

    eclipse-cdt:

    [1:7.0.1-4]
    - Resolves: #678364
    - Modify a version of copy-platform so it does not add wild-cards       when looking in the dropins folder.

    [1:7.0.1-3]
    - Resolves: #679543, #678364
    - Fix libhover local patch to change location specifiers in glibc and       libstdc++ plug-ins.
    - Fix build so that it still works if eclipse-cdt-parsers is currently       installed.

    [1:7.0.1-2]
    - Resolves: #622713
    - Resolves: #668890
    - Fix problems with applying autotools and libhover local patches

    [1:7.0.1-1]
    - Resolves: #656333
    - Rebase to 7.0.1 (Helios SR1) including gdb hardware support fix
    - Rebase to Autotools/Libhover 0.7
    - Fix Eclipse bug 286162

    eclipse-changelog:

    [1:2.7.0-1]
    - Resolves: #669499
    - Update to 2.7.0.
    - Update requires.

    eclipse-dtp:

    [1.8.1-1.1]
    - RHEL 6.1 rebase.

    [1.8.1-1]
    - Update to 1.8.1 (Helios SR1).

    [1.8.0-1]
    - Update to 1.8.0 (Helios).
    - Clarify get-dtp.sh a bit.
    - Re-generate Java 6 patch.

    eclipse-emf:

    [2.6.0-1]
    - Resolves: #656344
    - Rebase to 2.6.0 (Helios SR1)

    eclipse-gef:

    [3.6.1-3]
    - Fix patch that disables examples source plugin.

    [3.6.1-2]
    - Remove example source JARs.
    - Don't build debuginfo.

    [3.6.1-1]
    - Update to 3.6.1.

    [3.6.0-1]
    - Update to 3.6.0.

    eclipse-linuxprofilingframework:

    [0.6.1-1]
    - Resolves: #669461
    - Rebase to Linux Tools 0.6.1 version.

    eclipse-mylyn:

    [3.4.2-9]
    - Fix incorrect install_loc path.
    - Resolves: rhbz#673174.

    [3.4.2-8]
    - Add back missing changelog entries.
    - Fix mixed tabs and spaces.

    [3.4.2-7]
    - Fix qualifier to match upstream.
    - Resolves:  rhbz#669819.

    [3.4.2-6]
    - Put back in %{_libdir} due to multilib issues.

    [3.4.2-5]
    - Fix symlink to updated jdom 1.1.1 jar.

    [3.4.2-4]
    - Fix symlink to non-existing versioned jar.

    [3.4.2-3]
    - Really fix FTBFS.

    [3.4.2-2]
    - Fix FTBFS RH Bz #660784

    [3.4.2-1]
    - Update to 3.4.2.

    [3.4.1-3]
    - Fix obsoletes/provides for eclipse-cdt-mylyn using an epoch of 2.

    [3.4.1-2]
    - Backport patch for wikitext to work with Fedora wiki.

    [3.4.1-1]
    - Update to 3.4.1.

    [3.4.0-4]
    - Add Wikitext SDK to eclipse-mylyn

    [3.4.0-3]
    - Relax cdt requires, remove extraneous links, fix xmlrpc split

    [3.4.0-2]
    - Add required jar links to mylyn dropins directory

    [3.4.0-1]
    - Update to 3.4.0. Add mylyn-commons feature, remove commons.soap

    eclipse-oprofile:

    [0.6.1-1]
    - Rebase to Linux tools 0.6.1.

    [0.5.0-1]
    - Resolves: #575107
    - Rebase to Linux tools 0.5.0.

    [0.4.0-2]
    - Only build on x86 and x86_64.

    [0.4.0-1]
    - 0.4.0 (long overdue)

    [0.2.0-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    [0.2.0-2]
    - Add -Dconfigs to fix compile.

    [0.2.0-1]
    - 0.2.0

    [0.1.0-4]
    - Rebuild for new pdebuild.

    [0.1.0-3]
    - Refined patch for gcc build failures.

    [0.1.0-2]
    - Add patch for gcc build failure.

    [0.1.0-1]
    - Initial packaging.

    eclipse-rse:

    [3.2-1]
    - Resolves: #656338
    - Rebase to 3.2 (Helios)

    [3.1.2-1]
    - Resolves: #566766
    - Rebase to 3.1.2 (Galileo SR2 version)
    - Remove oro requirement as it is not needed.

    [3.1.1-2.2]
    - Don't build debuginfo if building arch-specific packages.

    [3.1.1-2.1]
    - Only build on x86 and x86_64 since we only have eclipse on those arches

    [3.1.1-2]
    - Update plugin and feature version property files.

    [3.1.1-1]
    - Move to 3.1.1 tarball.

    [3.1-2]
    - Add BuildArch noarch.

    [3.1-1]
    - Move to 3.1 tarball.

    [3.0.3-4]
    - Resolves #514630

    [3.0.3-3]
    - Restrict arch support to those supported by prereq CDT.

    [3.0.3-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    [3.0.3-1]
    - Initial release.

    eclipse-valgrind:

    [0.6.1-1]
    - Upstream 0.6.1 release.

    [0.6.0-1]
    - Upstream 0.6.0 release.

    [0.5.0-2]
    - Match upstream qualifier.

    [0.5.0-1]
    - Rebase to 0.5.0.

    [0.4.1-1]
    - Upstream 0.4.1 release.

    [0.4.0-0.2]
    - Make it Exclusive i386 i486 i586 i686 pentium3 pentium4 athlon geode x86_64.

    [0.4.0-0.1]
    - Pre-release of 0.4.0.

    [0.3.0-1]
    - Upstream 0.3.0 release.

    [0.2.1-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    [0.2.1-2]
    - Fix Massif parsing for unknown symbols (Eclipse#281417).

    [0.2.1-1]
    - Upstream 0.2.1 release.

    [0.2.0-2]
    - Adding cachegrind plugin to fetch script.

    [0.2.0-1]
    - Upstream 0.2.0 release.

    [0.1.0-6]
    - Don't generate debuginfo (rhbz#494719).

    [0.1.0-5]
    - Rebuild for changes in pdebuild to not ship p2 metadata.

    [0.1.0-4]
    - Fixed Massif parser crashing on other locales.

    [0.1.0-3]
    - Changing to arch dependent for CDT dependency.
    - Setting minimum Valgrind requirement to 3.3.0.

    [0.1.0-2]
    - No eclipse-cdt on ppc64 -> ExcludeArch.

    [0.1.0-1]
    - Initial package.

    icu4j:

    [1:4.2.1-5]
    - Remove maven bits.
    - Restore missing changelog entries.

    [1:4.2.1-4]
    - Bring back epoch.

    [1:4.2.1-3]
    - fix arch-related statements so we build on s390 variants.

    [1:4.2.1-1]
    - Update to 4.2.1.

    jetty-eclipse:

    [6.1.24-2]
    - Resolves: #661845
    - Bump version to allow make tag to work.

    [6.1.24-1]
    - Resolves: #661845
    - Rebase to release based on jetty-6.1.24.

    objectweb-asm:

    [0:3.2-2.1]
    - Rebuild for RHEL 6.1.

    [0:3.2.1-2]
    - Change depmap parent id to asm (bug #606659)

    [0:3.2.1]
    - Upgrade to 3.2

    sat4j:

    [2.2.0-4]
    - update to 2.2.0 and move to RHEL 6.1
    - removed ecj dependency
    - fixed to run against Java 1.5+

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Eclipse software development environment provides a set of tools for C/C++ and Java development.

A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted Eclipse Help URL. (CVE-2010-4647)

The following Eclipse packages have been upgraded to the versions found in the official upstream Eclipse Helios SR1 release, providing a number of bug fixes and enhancements over the previous versions :

  - eclipse to 3.6.1.

  - eclipse-cdt to 7.0.1.

  - eclipse-birt to 2.6.0.

  - eclipse-emf to 2.6.0.

  - eclipse-gef to 3.6.1.

  - eclipse-mylyn to 3.4.2.

  - eclipse-rse to 3.2.

  - eclipse-dtp to 1.8.1.

  - eclipse-changelog to 2.7.0.

  - eclipse-valgrind to 0.6.1.

  - eclipse-callgraph to 0.6.1.

  - eclipse-oprofile to 0.6.1.

  - eclipse-linuxprofilingframework to 0.6.1.

In addition, the following updates were made to the dependencies of the Eclipse packages above :

  - icu4j to 4.2.1.

  - sat4j to 2.2.0.

  - objectweb-asm to 3.2.

  - jetty-eclipse to 6.1.24.

This update includes numerous upstream bug fixes and enhancements, such as :

  - The Eclipse IDE and Java Development Tools (JDT) :

    - projects and folders can filter out resources in the       workspace.

    - new virtual folder and linked files support.

    - the full set of UNIX file permissions is now       supported.

    - addition of the stop button to cancel long-running       wizard tasks.

    - Java editor now shows multiple quick-fixes via problem       hover.

    - new support for running JUnit version 4 tests.

    - over 200 upstream bug fixes.

  - The Eclipse C/C++ Development Tooling (CDT) :

    - new Codan framework has been added for static code       analysis.

    - refactoring improvements such as stored refactoring       history.

    - compile and build errors now highlighted in the build       console.

    - switch to the new DSF debugger framework.

    - new template view support.

    - over 600 upstream bug fixes.

This update also fixes the following bugs :

  - Incorrect URIs for GNU Tools in the 'Help Contents'     window have been fixed.

  - The profiling of binaries did not work if an Eclipse     project was not in an Eclipse workspace. This update     adds an automated test for external project profiling,     which corrects this issue.

  - Running a C/C++ application in Eclipse successfully     terminated, but returned an I/O exception not related to     the application itself in the Error Log window. With     this update, the exception is no longer returned.

  - The eclipse-mylyn package showed a '20100916-0100-e3x'     qualifier. The qualifier has been modified to     'v20100902-0100-e3x' to match the upstream version of     eclipse-mylyn.

  - Installing the eclipse-mylyn package failed and returned     a 'Resource temporarily unavailable' error message due     to a bug in the packaging. This update fixes this bug     and installation now works as expected.

  - Building the eclipse-cdt package could fail due to an     incorrect interaction with the local file system.
    Interaction with the local file system is now prevented     and the build no longer fails.

  - The libhover plug-in, provided by the eclipse-cdt     package, used binary data to search for hover topics.
    The data location was specified externally as a URL     which could cause an exception to occur on a system with     no Internet access. This update modifies the plug-in so     that it pulls the needed data from a local location.

Users of eclipse should upgrade to these updated packages, which correct these issues and add these enhancements.

Updated eclipse packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Eclipse software development environment provides a set of tools for C/C++ and Java development.

A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted Eclipse Help URL. (CVE-2010-4647)

The following Eclipse packages have been upgraded to the versions found in the official upstream Eclipse Helios SR1 release, providing a number of bug fixes and enhancements over the previous versions :

* eclipse to 3.6.1. (BZ#656329) * eclipse-cdt to 7.0.1. (BZ#656333) * eclipse-birt to 2.6.0. (BZ#656391) * eclipse-emf to 2.6.0. (BZ#656344)
* eclipse-gef to 3.6.1. (BZ#656347) * eclipse-mylyn to 3.4.2.
(BZ#656337) * eclipse-rse to 3.2. (BZ#656338) * eclipse-dtp to 1.8.1.
(BZ#656397) * eclipse-changelog to 2.7.0. (BZ#669499) * eclipse-valgrind to 0.6.1. (BZ#669460) * eclipse-callgraph to 0.6.1.
(BZ#669462) * eclipse-oprofile to 0.6.1. (BZ#670228) * eclipse-linuxprofilingframework to 0.6.1. (BZ#669461)

In addition, the following updates were made to the dependencies of the Eclipse packages above :

* icu4j to 4.2.1. (BZ#656342) * sat4j to 2.2.0. (BZ#661842) * objectweb-asm to 3.2. (BZ#664019) * jetty-eclipse to 6.1.24.
(BZ#661845)

This update includes numerous upstream bug fixes and enhancements, such as :

* The Eclipse IDE and Java Development Tools (JDT) :

  - projects and folders can filter out resources in the     workspace. - new virtual folder and linked files     support. - the full set of UNIX file permissions is now     supported. - addition of the stop button to cancel     long-running wizard tasks. - Java editor now shows     multiple quick-fixes via problem hover. - new support     for running JUnit version 4 tests. - over 200 upstream     bug fixes.

* The Eclipse C/C++ Development Tooling (CDT) :

  - new Codan framework has been added for static code     analysis. - refactoring improvements such as stored     refactoring history. - compile and build errors now     highlighted in the build console. - switch to the new     DSF debugger framework. - new template view support. -     over 600 upstream bug fixes.

This update also fixes the following bugs :

* Incorrect URIs for GNU Tools in the 'Help Contents' window have been fixed. (BZ#622713)

* The profiling of binaries did not work if an Eclipse project was not in an Eclipse workspace. This update adds an automated test for external project profiling, which corrects this issue. (BZ#622867)

* Running a C/C++ application in Eclipse successfully terminated, but returned an I/O exception not related to the application itself in the Error Log window. With this update, the exception is no longer returned. (BZ#668890)

* The eclipse-mylyn package showed a '20100916-0100-e3x' qualifier.
The qualifier has been modified to 'v20100902-0100-e3x' to match the upstream version of eclipse-mylyn. (BZ#669819)

* Installing the eclipse-mylyn package failed and returned a 'Resource temporarily unavailable' error message due to a bug in the packaging.
This update fixes this bug and installation now works as expected.
(BZ#673174)

* Building the eclipse-cdt package could fail due to an incorrect interaction with the local file system. Interaction with the local file system is now prevented and the build no longer fails.
(BZ#678364)

* The libhover plug-in, provided by the eclipse-cdt package, used binary data to search for hover topics. The data location was specified externally as a URL which could cause an exception to occur on a system with no Internet access. This update modifies the plug-in so that it pulls the needed data from a local location. (BZ#679543)

Users of eclipse should upgrade to these updated packages, which correct these issues and add these enhancements.

A vulnerability has been found and corrected in eclipse :

Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) help/index.jsp or (2) help/advanced/content.jsp (CVE-2010-4647).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

Eclipse help webapp XSS vulnerability fix. See Redhat Bugzilla #661901 and Eclipse Bugzilla #329582.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix junit runner problem Eclipse help webapp XSS vulnerability fix.
See Redhat Bugzilla #661901 and Eclipse Bugzilla #329582.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199996	RHEL 5 : eclipse (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
181063	Oracle Linux 6 : eclipse (ELSA-2011-0568)	Nessus	Oracle Linux Local Security Checks	medium
61040	Scientific Linux Security Update : eclipse on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
54595	RHEL 6 : eclipse (RHSA-2011:0568)	Nessus	Red Hat Local Security Checks	medium
52041	Mandriva Linux Security Advisory : eclipse (MDVSA-2011:032)	Nessus	Mandriva Local Security Checks	medium
51376	Fedora 14 : eclipse-3.6.1-6.1.fc14 (2010-19006)	Nessus	Fedora Local Security Checks	medium
51375	Fedora 13 : eclipse-3.5.2-4.fc13 (2010-18990)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-4647

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium