This build upgrades jetty to 5.1.15 which addresses CVE-2009-1523.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been identified and corrected in jetty5 :

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty before 6.1.17, and 7.0.0.M2 and earlier 7.x versions, allows remote attackers to access arbitrary files via directory traversal sequences in the URI (CVE-2009-1523).

This update fixes this vulnerability.

This update fixes a directory traversal bug in jetty5's HTTP server.
(CVE-2009-1523: CVSS v2 Base Score: 7.1)

リモートWindowsホストにインストールされているVMware vCenter Update Managerのバージョンは、Update 3より前の4.0、またはUpdate 1より前の4.1です。このため、インストールされているバージョンは、埋め込みJetty Webサーバーの複数の脆弱性の影響を受ける可能性があります：

  - ディレクトリトラバーサルの脆弱性により、認証されていないリモートの攻撃者が、リモートホストからファイルを取得する可能性があります。（CVE-2009-1523）

  - クロスサイトスクリプティングの脆弱性により、リモートの攻撃者が、ユーザーのブラウザで任意のスクリプトコードを実行する可能性があります。（CVE-2009-1524）

This build upgrades jetty to 5.1.15 which addresses CVE-2009-1523

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

遠端 Windows 主機上安裝的 VMware vCenter Update Manager 版本為 Update 3 以前的 4.0 版或 Update 1 以前的 4.1 版。因此所安裝的版本可能受到內嵌 Jetty Web 伺服器中的多個弱點影響：

- 一個目錄遊走弱點允許未經驗證的遠端攻擊者從遠端主機取得檔案。(CVE-2009-1523)

- 一個跨網站指令碼弱點允許遠端攻擊者在使用者的瀏覽器中執行任意指令碼。(CVE-2009-1524)

远程 Windows 主机上安装的 VMware vCenter Update Manager 版本为低于 Update 3 的 4.0 或低于 Update 1 的 4.1。因此所安装的版本可能受到内嵌 Jetty Web 服务器中的多个漏洞影响：

- 一个目录遍历漏洞，允许未经认证的远程攻击者从远程主机取得文件。(CVE-2009-1523)

- 一个跨站脚本漏洞，允许远程攻击者在用户的浏览器中执行任意脚本代码。(CVE-2009-1524)

The version of VMware vCenter Update Manager installed on the remote Windows host is 4.0 earlier than Update 3 or 4.1 earlier than Update 1. The installed version is, therefore, potentially affected by multiple vulnerabilities in the embedded Jetty Web server :

  - A directory traversal vulnerability allows a remote,     unauthenticated attacker to obtain files from the     remote host. (CVE-2009-1523)

  - A cross-site scripting vulnerability allows a remote     attacker to execute arbitrary script code in the user's     browser. (CVE-2009-1524)

This bug upgrades jetty to 5.1.15 which addresses CVE-2009-1523. * Wed Feb 11 2009 Jeff Johnston <jjohnstn at redhat.com> 5.1.14-1.10 - Rename jettyc back to .jettyrc. - Resolves #485012 * Tue Feb 03 2009 Jeff Johnston <jjohnstn at redhat.com> 5.1.14-1.9 - Change %%{_sysconfdir}/init.d references to be %%{_initrddir} - Resolves #473585 * Mon Feb 02 2009 Jeff Johnston <jjohnstn at redhat.com> 5.1.14-1.8 - Fixes for unowned directories.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote instance of Mort Bay Jetty is vulnerable to a number of flaws.  First, the application is vulnerable to a cross-site-scripting flaw when displaying web directory listings.  Secondly, the application is prone to an information disclosure flaw which can be used to read files outside the web root.  Note:  in order for the second flaw to be executed, Jetty must have been configured to have DefaultServlet with support for aliases turned on.

ID	名稱	產品	系列	已發布	已更新	嚴重性
38918	Fedora 11 : jetty-5.1.15-4.fc11 (2009-5509)	Nessus	Fedora Local Security Checks	2009/5/27	2021/1/11	medium
42311	Mandriva Linux Security Advisory : jetty5 (MDVSA-2009:291)	Nessus	Mandriva Local Security Checks	2009/10/30	2021/1/6	medium
42463	openSUSE Security Update : jetty5 (jetty5-1531)	Nessus	SuSE Local Security Checks	2009/11/11	2021/1/14	medium
52014	VMSA-2010-0012 : Jetty Web サーバーのための VMware vCenter Update Manager の修正	Nessus	Windows	2011/2/17	2021/1/6	medium
38917	Fedora 9 : jetty-5.1.15-3.fc9 (2009-5500)	Nessus	Fedora Local Security Checks	2009/5/27	2021/1/11	medium
52014	VMSA-2010-0012：適用於 Jetty Web 伺服器的 VMware vCenter Update Manager 修正	Nessus	Windows	2011/2/17	2021/1/6	medium
52014	VMSA-2010-0012：适用于 Jetty Web 服务器的 VMware vCenter Update Manager 补丁	Nessus	Windows	2011/2/17	2021/1/6	medium
52014	VMSA-2010-0012 : VMware vCenter Update Manager Fix for Jetty Web Server	Nessus	Windows	2011/2/17	2021/1/6	medium
38919	Fedora 10 : jetty-5.1.15-3.fc10 (2009-5513)	Nessus	Fedora Local Security Checks	2009/5/27	2021/1/11	medium
5017	Mort Bay Jetty < 6.1.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2004/8/18	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium