Java Connector Server Vulnerability Assessment for CVE-2009-4611

Products

• CA Identity Manager

Issue/Introduction

Security penetration scans may flag the Java Connector Server (JCS) for vulnerability CVE-2009-4611 (Escape Sequence Injection). This vulnerability typically impacts older versions of the Jetty web container

Environment

• Product: CA Identity Manager
• Component: Java Connector Server (JCS)
• Release: 14.3.x, 14.4.x

Cause

CVE-2009-4611 primarily impacts Jetty versions 6.x through 6.1.22 and 7.0.0.

Identity Manager JCS 14.3 and 14.4 utilize Jetty v7.2.2, which is inherently not impacted by this CVE. However, the JCS implementation includes a customization that leverages the servicemix bundle for jetty v6.1.26_1-fuse library.

False Positives

Because of the inclusion of the ServiceMix bundle (org.apache.servicemix.bundles.jetty-6.1.26_1-fuse.jar), some scanning tools may report a false positive by identifying a legacy Jetty version (e.g., via curl -vvv).

Resolution

Identity Manager is not vulnerable to CVE-2009-4611. The vulnerability cannot be exploited through the Jetty customization used in JCS for the following reasons:

1. Trimmed Library: The org.apache.servicemix.bundles.jetty-6.1.26_1-fuse.jar is a trimmed OSGi bundle that does not include the sample code comprising the vulnerable components, such as the "Cookie Dump Servlet" or the "jsp/expr.jsp" file.
2. No Direct Exposure: JCS uses Jetty libraries for internal processes only. The Jetty web container capabilities and the specific vulnerable code paths are not exposed to end-users or external network requests.
3. OSGi Constraint: As this library is a part of Apache ServiceMix, it can only be updated when the ServiceMix component itself is upgraded within JCS.

In summary, while the legacy library name may trigger scan alerts, the actual vulnerable code is absent and unexploitable within the JCS environment.

Additional Information

For further technical details on this vulnerability, refer to the NVD Detail for CVE-2009-4611.