exploit the possibilities

Netbeans Jira Plugin SSL Certificate Fail

Netbeans Jira Plugin SSL Certificate Fail
Posted Feb 8, 2012
Authored by Carlos Pantelides

The Netbeans Jira plugin does not validate HTTPS certificates and is quietly vulnerable to man in the middle attacks.

tags | advisory, web
MD5 | 4d61ced3b2b5e390e5e45d44b17fa248

Netbeans Jira Plugin SSL Certificate Fail

Change Mirror Download


Title:
-------
Netbeans Jira Plugin does not check https certificates

Disclosure Timeline:
-----------------------------
[2012-01-02] Vulnerability reported (http://netbeans.org/bugzilla/show_bug.cgi?id=206848)
[2012-01-03] Assigned
[2012-01-30] More info added and asked for status
[2012-02-08] No answer, fully disclosed


Introduction
------------

Jira is a project tracking tool. It provides an API. (www.atlassian.com/software/jira)

Netbeans is an IDE that can consume Jira's API (www.netbeans.org)

As provided by Atlassian Jira Studio, the API is protected at the transport layer with https.


Details
-------
Connecting to a jira instance through an intercepting proxy like webscarab raise no warning from the IDE nor the plugin,
so you can decrypt the conversation, including username and password.

Checked that other applications detected the wrong certificates.



Affected Versions
----------------------
NetBeans IDE 7.0.1 (Build 201107282000)
NetBeans IDE 7.1 (Build 201112071828)
NetBeans IDE Dev (Build 201201260600)


Carlos Pantelides
-----------------
http://seguridad-agile.blogspot.com/ 

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

June 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    1 Files
  • 2
    Jun 2nd
    2 Files
  • 3
    Jun 3rd
    19 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    15 Files
  • 6
    Jun 6th
    12 Files
  • 7
    Jun 7th
    11 Files
  • 8
    Jun 8th
    1 Files
  • 9
    Jun 9th
    1 Files
  • 10
    Jun 10th
    15 Files
  • 11
    Jun 11th
    15 Files
  • 12
    Jun 12th
    15 Files
  • 13
    Jun 13th
    8 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close