CVE-2013-0158: Insufficient Information (NVD-CWE-noinfo)
value: Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2013-02-24T22:55Z
Repository: https://github.com/jenkinsci/jenkins
Language: Java
Files changed: core/src/main/java/jenkins/model/Jenkins.java, core/src/main/java/jenkins/security/RekeySecretAdminMonitor.java
Commit date: 2013-01-05 15:32:41 -0800
Commit message: [SECURITY-49] mark secret.key generated by post SECURITY-49 Jenkins.

If JENKINS_HOME is created by a post SECURIT-49 Jenkins (LTS, and other
variants), then there's no need to alarm the user.

Diff: diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java
index bb9b8efc5..0e1805abf 100755
--- a/core/src/main/java/jenkins/model/Jenkins.java
+++ b/core/src/main/java/jenkins/model/Jenkins.java
@@ -196,10 +196,11 @@ import jenkins.ExtensionComponentSet;
 import jenkins.ExtensionRefreshException;
 import jenkins.InitReactorRunner;
 import jenkins.model.ProjectNamingStrategy.DefaultProjectNamingStrategy;
 import jenkins.security.ConfidentialKey;
 import jenkins.security.ConfidentialStore;
+import jenkins.util.io.FileBoolean;
 import net.sf.json.JSONObject;
 import org.acegisecurity.AccessDeniedException;
 import org.acegisecurity.AcegiSecurityException;
 import org.acegisecurity.Authentication;
 import org.acegisecurity.GrantedAuthority;
@@ -775,10 +776,14 @@ public class Jenkins extends AbstractCIBase implements ModifiableTopLevelItemGro
                 SecureRandom sr = new SecureRandom();
                 byte[] random = new byte[32];
                 sr.nextBytes(random);
                 secretKey = Util.toHexString(random);
                 secretFile.write(secretKey);
+
+                // this marker indicates that the secret.key is generated by the version of Jenkins post SECURITY-49.
+                // this indicates that there's no need to rewrite secrets on disk
+                new FileBoolean(new File(root,"secret.key.not-so-secret")).on();
             }
 
             try {
                 proxy = ProxyConfiguration.load();
             } catch (IOException e) {
diff --git a/core/src/main/java/jenkins/security/RekeySecretAdminMonitor.java b/core/src/main/java/jenkins/security/RekeySecretAdminMonitor.java
index 5bdd61031..a5ce72c82 100644
--- a/core/src/main/java/jenkins/security/RekeySecretAdminMonitor.java
+++ b/core/src/main/java/jenkins/security/RekeySecretAdminMonitor.java
@@ -62,11 +62,13 @@ public class RekeySecretAdminMonitor extends AdministrativeMonitor implements St
     public RekeySecretAdminMonitor() throws IOException {
         // if JENKINS_HOME existed <1.497, we need to offer rewrite
         // this computation needs to be done and the value be captured,
         // since $JENKINS_HOME/config.xml can be saved later before the user has
         // actually rewritten XML files.
-        if (Jenkins.getInstance().isUpgradedFromBefore(new VersionNumber("1.496.*")))
+        Jenkins j = Jenkins.getInstance();
+        if (j.isUpgradedFromBefore(new VersionNumber("1.496.*"))
+        &&  new FileBoolean(new File(j.getRootDir(),"secret.key.not-so-secret")).isOff())
             needed.on();
     }
 
     /**
      * Requires ADMINISTER permission for any operation in here.

Vulnerable code:         if (Jenkins.getInstance().isUpgradedFromBefore(new VersionNumber("1.496.*")))
Fixed code: import jenkins.util.io.FileBoolean;

                // this marker indicates that the secret.key is generated by the version of Jenkins post SECURITY-49.
                // this indicates that there's no need to rewrite secrets on disk
                new FileBoolean(new File(root,"secret.key.not-so-secret")).on();
        Jenkins j = Jenkins.getInstance();
        if (j.isUpgradedFromBefore(new VersionNumber("1.496.*"))
        &&  new FileBoolean(new File(j.getRootDir(),"secret.key.not-so-secret")).isOff())