Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jetty: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-4461)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by vulnerabilities in the following subcomponents of the Enterprise Manager Base Platform component :

  - Agent
  - UI Framework
  - Process Management & Notification

Note that the product was formerly known as the Enterprise Manager Grid Control.

jetty5 was prone to a remotely exploitable Denial of Service flaw via hash collisions (CVE-2011-4461).

jetty5 was prone to a remotely exploitable Denial of Service flaw via hash collisions

It was discovered that Jetty computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. This could allow a remote attacker to cause a denial of service by sending many crafted parameters.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Back-port of upstream jetty patches for CVE-2011-4461, hash DOS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Back-port of upstream jetty patches for CVE-2011-4461 - hash table collisions DoS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199529	RHEL 6 : jetty-eclipse (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
80966	Oracle Enterprise Manager Cloud Control Multiple Vulnerabilities (January 2015 CPU)	Nessus	Misc.	medium
75875	openSUSE Security Update : jetty5 (openSUSE-SU-2012:0262-1)	Nessus	SuSE Local Security Checks	medium
74553	openSUSE Security Update : jetty5 (openSUSE-2012-128)	Nessus	SuSE Local Security Checks	medium
58892	Ubuntu 10.04 LTS / 11.04 : jetty vulnerability (USN-1429-1)	Nessus	Ubuntu Local Security Checks	medium
58462	Fedora 15 : jetty-6.1.26-7.fc15 (2012-0752)	Nessus	Fedora Local Security Checks	medium
58461	Fedora 16 : jetty-6.1.26-8.fc16 (2012-0730)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-4461

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium