FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2007-6672

This CVE name corresponds to:

Entered	Topic
2008-02-04	jetty -- multiple vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2007-6672 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2007-6672
Phase	Assigned(20080107)

Description

Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.

References

Source	Reference
MISC	http://www.igniterealtime.org/community/message/163752
CONFIRM	http://jira.codehaus.org/browse/JETTY-386#action_117699
CONFIRM	http://jira.codehaus.org/browse/JETTY/fixforversion/13950
CERT-VN	VU#553235
BID	27117
OSVDB	39855
VUPEN	ADV-2008-0079
SECUNIA	28322
SECUNIA	28547