Info

Disclosure

Oct 10, 2005

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

BEA WebLogic contains a flaw that may lead to an unauthorized information disclosure. The problem is triggered when a client logs in by using one-way SSL without specifiying the user which results in unprotected network traffic.

Classification

Location: Remote/Network Access Required
Attack Type: Cryptographic
Impact: Loss of Confidentiality
Exploit: Exploit Unknown
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 8.1 Service Pack 4 or higher, as it has been reported to fix this vulnerability. In addition, BEA Systems has released a patch for version 7.0 Service Pack 6 and 6.1 Service Pack 7.

Products

BEA Systems, Inc.	BEA WebLogic Server/Express	8.1 Service Pack 3
		7.0 Service Pack 6
		6.1 Service Pack 7

References

Security Tracker: 1015029
Bugtraq ID: 15052
Secunia Advisory ID: 17138
CVE ID: 2005-4704 (see also: NVD)
Keyword: BEA05-85.00
Vendor Specific Advisory URL: http://dev2dev.bea.com/pub/advisory/140
Vendor URL: http://www.bea.com/

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

BEA Systems, Inc.

BEA WebLogic Server/Express

References

Credit