Jetty Web Form Hash Collision Denial of Service Vulnerability

SA47408

CVE-2011-4461

29 Dec 2011

Less Critical

Unpatched

Jetty 6.x
Jetty 7.x

From remote

DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

A vulnerability has been reported in Jetty, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within a hash generation function when hashing form posts and updating a hash table. This can be exploited to cause a hash collision resulting in high CPU consumption via a specially crafted form sent in a HTTP POST request.

Currently there is no known workaround.

Alexander Klink, n.runs AG and Julian Wälde, Technische Universität Darmstadt

n.runs (SA-2011.004):
http://www.nruns.com/_downloads/advisory28122011.pdf

oCERT (#2011-003):
http://www.ocert.org/advisories/ocert-2011-003.html