HTTP request smuggling attack in Jetty - CVE-2017-7656

Vulnerability identifier: #VU13527

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7656

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to conduct an HTTP request smuggling attack on the target system.

The vulnerability exists due to improper handling of HTTP/0.9 requests. A remote attacker can send a specially crafted HTTP/0.9 request that submits malicious request headers, cause the software and an upstream HTTP agent to misinterpret the boundary of the request and poison the web cache on the system, which could be used to conduct further attacks.

Jetty
IBM Business Automation Workflow
Crowd Data Center
IBM Tivoli Netcool/OMNIbus WebGUI
Jira Software Data Center
IBM Cloud Application Performance Management (APM)
IBM Spectrum Protect Storage Agent
IBM Security Verify Governance
Debian Linux
Fedora
Security Directory Integrator
Dell Support Assist Enterprise
IBM Security Verify Directory
IBM Enterprise Records
IBM Security Directory Suite
CloudLink
BIG-IP
Crowd Server
BIG-IQ Centralized Management
Jira Software Server
IBM Cognos Command Center
jetty

The vulnerability is addressed in the versions 9.3.24.v20180605 and 9.4.11.v20180605.

Jetty - addressed in versions 9.3.24.v20180605, 9.4.11.v20180605
Dell Support Assist Enterprise - update to 4.00.06.00
Crowd Data Center - addressed in versions 5.0.11, 5.1.9, 5.2.4
Crowd Server - addressed in versions 5.0.11, 5.1.9, 5.2.4
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.29
Jira Software Data Center - addressed in versions 8.20.27, 9.10.2, 9.11.1
Jira Software Server - addressed in versions 8.20.27, 9.10.2, 9.11.1
IBM Enterprise Records - update to 5.2.1.8 IF002
IBM Security Directory Suite - update to 8.0.1.21
CloudLink - update to 8.0-3.10.5.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Spectrum Protect Storage Agent - update to 8.1.19
jetty - addressed in versions 9.4.11-2.v20180605.fc27, 9.4.11-2.v20180605.fc28
IBM Security Verify Governance - update to 10.0.1.0.3
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17

• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00123.html

• Multiple vulnerabilities in Eclipse Jetty
• Debian update for jetty9
• HTTP request smuggling in BIG-IP iControl REST
• HTTP request smuggling in BIG-IQ Centralized Management Restjavad
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus
• Multiple vulnerabilities in IBM Enterprise Records
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Dell CloudLink
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM Storage Protect Server
• Jira Software Data Center and Server update for Jetty
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Security Directory Integrator
• Crowd Data Center and Server update for jetty-server
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM Security Verify Directory
• Multiple vulnerabilities in IBM Security Directory Suite
• Fedora 28 update for jetty
• Fedora 27 update for jetty
• Multiple vulnerabilities in IBM Business Automation Workflow traditional