|
BEA WebLogic Server/Express Multiple Security Issues
|
|
Secunia Advisory:
|
SA20130
|
|
|
Release Date:
|
2006-05-16
|
|
Last Update:
|
2006-07-20
|
|
Popularity:
|
12,072 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
Exposure of system information
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Workaround
|
|
| Software: | BEA WebLogic Express 6.x
BEA WebLogic Express 7.x
BEA WebLogic Express 8.x
BEA WebLogic Express 9.x
BEA WebLogic Server 6.x
BEA WebLogic Server 7.x
BEA WebLogic Server 8.x
BEA WebLogic Server 9.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-2546
CVE-2006-2461
CVE-2006-2462
CVE-2006-2464
CVE-2006-2466
CVE-2006-2467
CVE-2006-2468
CVE-2006-2469
CVE-2006-2470
CVE-2006-2472
CVE-2006-2471
|
|
Description:
Multiple security issues and a vulnerability have been reported in WebLogic Server / Express, which can be exploited by malicious people to disclose system and sensitive information, and bypass certain security restrictions.
1) Transactions are being sent over insecure channels for sites where JTA transactions are used over non-secure channels.
The security issue affects the following versions:
* WebLogic Server 8.1 through Service Pack 4 (all platforms)
* WebLogic Server 7.0 through Service Pack 6 (all platforms)
2) An error caused due to the client connection manager not properly setting the Quality of Service on a channel in certain situations may cause some transaction coordinator messages to be sent over a non-SSL channel.
The security issue affects the following version:
* WebLogic Server 8.1 through Service Pack 3 (all platforms)
3) An error in the admin password reset mechanism may cause the admin password to be stored in clear-text in the domain directory.
NOTE: This only affects sites which have been following certain instructions as described in BEA06-131.00.
The security issue affects the following version:
* WebLogic Server 8.1
4) An error in the handling of JavaServer Pages with compilation errors can be exploited to disclose the source code of ".jsp" files.
The vulnerability affects the following versions:
* WebLogic Server 8.1 through Service Pack 4
* WebLogic Server 7.0 through Service Pack 6
5) An error exists due to the internal server IP being disclosed when using the Administration Console to connect to the server.
Successful exploitation requires administrative privileges.
The security issue affects the following versions:
* WebLogic Server 8.1 through Service Pack 4
* WebLogic Server 7.0 through Service Pack 6
* WebLogic Server 6.1 through Service Pack 7
6) The domain name is improperly displayed when accessing the login form of the Administration Console via HTTP/HTTPS.
The security issue affects the following versions:
* WebLogic Server 8.1 through service pack 4 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)
7) An error exists due to the username and password being logged in clear-text to the server log on an access failure when accessing protected JWS (Java Web Service) or web applications for sites that use WebLogic Server HTTP handlers.
The security issue affects the following versions:
* WebLogic Server 9.0 (all platforms)
* WebLogic Server 8.1 through service pack 5 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)
* WebLogic Server 6.1 through service pack 7 (all platforms)
8) The Administration Console does not set custom JDBC policies correctly, which may cause JDBC resources not being properly secured.
The security issue affects the following version:
* WebLogic Server 9.0 (all platforms)
9) Some errors exists where various internal network information may be improperly disclosed in certain situations.
The security issues affect the following versions:
* WebLogic Server 8.1 through service pack 4 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)
* WebLogic Server 6.1 through service pack 7 (all platforms)
10) An error caused due to private keys not being properly protected can be exploited by malicious applications running on the server to disclose private keys.
The security issue affects the following versions:
* WebLogic Server 9.1 (all platforms)
* WebLogic Server 9.0 (all platforms)
* WebLogic Server 8.1 through service pack 5 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)
* WebLogic Server 6.1 through service pack 7 (all platforms)
11) Passwords are echoed back to standard output when an administrator uses the "stopWebLogic.sh" script to shutdown a server.
The security issue affects the following versions:
* WebLogic Platform 8.1 through Service Pack 2 (on UNIX platforms)
* WebLogic Platform 7.0 through Service Pack 5 (on UNIX platforms)
Solution:
Apply patches and service packs (see the original vendor advisories).
3) The vendor recommends changing the administrator password via the console (see vendor advisory BEA06-131.00 for more information).
Provided and/or discovered by:
Reported by the vendor.
Changelog:
2006-05-19: Corrected link to BEA06-127.00.
2006-05-25: Added CVE reference.
2006-07-19: Added CVE references.
2006-07-20: Added CVE reference.
2006-07-20: Added CVE reference.
2006-07-20: Added CVE reference.
Original Advisory:
BEA06-133.00:
http://dev2dev.bea.com/pub/advisory/195
BEA06-132.00:
http://dev2dev.bea.com/pub/advisory/194
BEA06-131.00:
http://dev2dev.bea.com/pub/advisory/193
BEA06-130.00:
http://dev2dev.bea.com/pub/advisory/192
BEA06-129.00:
http://dev2dev.bea.com/pub/advisory/191
BEA06-128.00:
http://dev2dev.bea.com/pub/advisory/190
BEA06-127.00:
http://dev2dev.bea.com/pub/advisory/189
BEA06-126.00:
http://dev2dev.bea.com/pub/advisory/188
BEA06-125.00:
http://dev2dev.bea.com/pub/advisory/187
BEA06-124.00:
http://dev2dev.bea.com/pub/advisory/186
BEA06-121.00:
http://dev2dev.bea.com/pub/advisory/181
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
