MOABI : Continuous Software Improvement

CVE-2009-5047
Description	Jetty 6.x through 6.1.22 suffers from an escape sequence injection vulnerability from an attack vector by means of: 1) "Cookie Dump Servlet" and 2) Http Content-Length header. 1) A POST request to the form at "/test/cookie/" with the "Age" parameter set to a string throws a "java.lang.NumberFormatException" which reflects binary characters including ESC. These characters could be used to execute arbitrary commands or buffer dumps in the terminal. 2) The attack vector in 1) can be exploited by requesting a page using an HTTP request "Content-Length" header set to a consonant string (string including only letters).
Impact	CVSS v3 : 9.8 CRITICAL CVSS v2 : 7.5 HIGH
Type	CWE-119
Attack Vector	CVSSv2 Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P
Quick links	CVE, NVD, CERT, Metasploit, Exploit-db, Fulldisc, Bugtraq, Microsoft, Red Hat, Debian, GitHub code/issues, Google
References	http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt https://security-tracker.debian.org/tracker/CVE-2009-5047 https://www.openwall.com/lists/oss-security/2011/01/14/2