CVE-2009-4611: Input Validation
Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4611?
CVE-2009-4611 is a medium severity vulnerability due to non-sanitized backtrace data that can be exploited by remote attackers.
How do I fix CVE-2009-4611?
To fix CVE-2009-4611, upgrade your Mort Bay Jetty installation to a version later than 6.1.22 or 7.0.0.
What types of applications are affected by CVE-2009-4611?
CVE-2009-4611 affects various versions of Mort Bay Jetty 6.x and 7.x applications.
Can CVE-2009-4611 lead to remote code execution?
Yes, CVE-2009-4611 can potentially allow remote attackers to execute arbitrary commands.
What is the impact of CVE-2009-4611 on web applications?
CVE-2009-4611 can allow attackers to modify UI elements like window titles or overwrite files in web applications.