Mailing-List: contact user-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@geronimo.apache.org
Received-SPF: pass (athena.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=dk20050327; d=earthlink.net;
  b=WKrRiN6VsNqMKnz7mGkxLMeYfAk8GwoWhT4lcXNXD9OkxtjqoFLB7Deb7BLHPLnF;
  h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:References:In-Reply-To:Content-Type:Content-Transfer-Encoding:X-ELNK-Trace:X-Originating-IP;
Message-ID: <478E5F68.7040802@earthlink.net>
Date: Wed, 16 Jan 2008 14:47:52 -0500
From: Joe Bohn <joe.bohn@earthlink.net>
User-Agent: Thunderbird 2.0.0.9 (Macintosh/20071031)
MIME-Version: 1.0
To: user@geronimo.apache.org
Subject: Re: [SECURITY] Potential vulnerability in Jetty servlet container
References: <478BBC36.40505@earthlink.net>
In-Reply-To: <478BBC36.40505@earthlink.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

I've updated this notice with a better location from which to obtain the 
jetty-6.1.7.jar (see below).

Joe Bohn wrote:
> The Geronimo project has learned of a security vulnerability in the 
> Jetty servlet container (6.1.5) included in Geronimo.  If you use a 
> Jetty configuration of Geronimo you may be affected by the vulnerability.
> 
> This vulnerability impacts Jetty configurations of Geronimo 2.0.1 and 
> 2.0.2.
> 
> For specific information regarding the Jetty vulnerability, see
> http://www.kb.cert.org/vuls/id/553235
> 
> The problem is related to the processing of URLs which contain multiple 
> consecutive forward slash (/) characters that are handled incorrectly 
> (for example . http://foo//../bar).
> 
> If your system is susceptible to attacks using such URLs we recommend 
> that you filter these URLs using an application firewall or reverse 
> proxy server.
> 
> Alternatively, you can upgrade your Geronimo Jetty server image to 
> utilize the corrected Jetty 6.1.7 jar:
> - Obtain a jetty-6.1.7.jar from 
http://repo1.maven.org/maven2/org/mortbay/jetty/jetty/6.1.7/jetty-6.1.7.jar
> - Stop your Geronimo Jetty server image
> - copy jetty-6.1.7.jar to 
> <geronimo-root>/repository/org/mortbay/jetty/jetty/6.1.7/jetty-6.1.7.jar
> - remove the jetty 6.1.5 jar: 
> <geronimo-root>/repository/org/mortbay/jetty/jetty/6.1.5/jetty-6.1.5.jar
> - start the Geronimo Jetty server.  The server will now be using the 
> 6.1.7 Jetty jar.
> 
> This vulnerability will be fixed in the next release of Geronimo (2.0.3 
> and/or 2.1) which will include Jetty 6.1.7 correcting the vulnerability.
> 
>