Secunia

Description

BEA has issued patches for BEA WebLogic Server and Express. These fix 5 different vulnerabilities, which can be exploited to cause a Denial of Service or expose sensitive information.

1) The proxy plug-in fails to handle certain incorrectly formatted URLs allowing malicious people to crash the proxy plug-in. This causes the websites to become inaccessible.

2) WebLogic may fail to wrap T3 in SSL when the URI handler has been specified as T3S. This happens if the port for the non-SSL enabled port is specified. This may expose data, which should be protected.

3) Passwords for foreign JMS providers are showed in clear-text in the console and is stored in clear-text in the "config.xml" file. This may expose the passwords to untrusted users.

4) Node Manager fails to handle invalid data such as data generated by port scanning tools. This may cause Node Manager to crash or stop responding.

5) The default settings for sites expose MBeanHome to anonymous users from JNDI with RMI access. This may expose various configuration MBeans.

WebLogic Server and Express 6.1 is affected by issues 1, 4, and 5.
WebLogic Server and Express 7.0 is affected by issues 1, 2, 4, and 5.
WebLogic Server and Express 8.1 is affected by issues 1, 2, 3, 4, and 5.

Solution
Patches and workarounds are available:
Further details available in Customer Area

Original Advisory
Remedies available to prevent Denial of Service
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03_39.00.jsp

Patches available to prevent unintended use of nonencypted connection
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03_40.00.jsp

Patches available to protect password
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03_41.00.jsp

Patches available to protect Node Manager
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03_42.00.jsp

Workaround available to prevent Mbean exposure
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03_43.00.jsp

Deep Links
Links available in Customer Area