CVE-2015-2080 – Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers

https://notcve.org/view.php?id=CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak. El código de manipulación de excepciones en Eclipse Jetty en versiones anteriores a 9.2.9.v20150224 permite a atacantes remotos obtener información sensible de memoria de procesos a través de caracteres no válidos en una cabecera HTTP, vulnerabilidad también conocida como JetLeak. Remote unauthenticated attackers are able to read arbitrary data from other HTTP sessions because Ignition uses a vulnerable Jetty server. When the Jetty web server receives a HTTP request, the below code is used to parse through the HTTP headers and their associated values. Inductive Automation versions 7.8.1 (b2016012216) and 7.8.0 (b2015101414) are affected. • https://www.exploit-db.com/exploits/39455 http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html http://seclists.org/fulldisclosure/2015/Mar/12 http://www.securityfocus.com/archive/1/534755/100/1600/threaded http://www.securityfocus.com/bid/72768 http • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •