Multiple security issues and a vulnerability have been reported in WebLogic Server / Express, which can be exploited by malicious people to disclose system and sensitive information, and bypass certain security restrictions.

1) Transactions are being sent over insecure channels for sites where JTA transactions are used over non-secure channels.

The security issue affects the following versions:
* WebLogic Server 8.1 through Service Pack 4 (all platforms)
* WebLogic Server 7.0 through Service Pack 6 (all platforms)

2) An error caused due to the client connection manager not properly setting the Quality of Service on a channel in certain situations may cause some transaction coordinator messages to be sent over a non-SSL channel.

The security issue affects the following version:
* WebLogic Server 8.1 through Service Pack 3 (all platforms)

3) An error in the admin password reset mechanism may cause the admin password to be stored in clear-text in the domain directory.

NOTE: This only affects sites which have been following certain instructions as described in BEA06-131.00.

The security issue affects the following version:
* WebLogic Server 8.1

4) An error in the handling of JavaServer Pages with compilation errors can be exploited to disclose the source code of ".jsp" files.

The vulnerability affects the following versions:
* WebLogic Server 8.1 through Service Pack 4
* WebLogic Server 7.0 through Service Pack 6

5) An error exists due to the internal server IP being disclosed when using the Administration Console to connect to the server.

Successful exploitation requires administrative privileges.

The security issue affects the following versions:
* WebLogic Server 8.1 through Service Pack 4
* WebLogic Server 7.0 through Service Pack 6
* WebLogic Server 6.1 through Service Pack 7

6) The domain name is improperly displayed when accessing the login form of the Administration Console via HTTP/HTTPS.

The security issue affects the following versions:
* WebLogic Server 8.1 through service pack 4 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)

7) An error exists due to the username and password being logged in clear-text to the server log on an access failure when accessing protected JWS (Java Web Service) or web applications for sites that use WebLogic Server HTTP handlers.

The security issue affects the following versions:
* WebLogic Server 9.0 (all platforms)
* WebLogic Server 8.1 through service pack 5 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)
* WebLogic Server 6.1 through service pack 7 (all platforms)

8) The Administration Console does not set custom JDBC policies correctly, which may cause JDBC resources not being properly secured.

The security issue affects the following version:
* WebLogic Server 9.0 (all platforms)

9) Some errors exists where various internal network information may be improperly disclosed in certain situations.

The security issues affect the following versions:
* WebLogic Server 8.1 through service pack 4 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)
* WebLogic Server 6.1 through service pack 7 (all platforms)

10) An error caused due to private keys not being properly protected can be exploited by malicious applications running on the server to disclose private keys.

The security issue affects the following versions:
* WebLogic Server 9.1 (all platforms)
* WebLogic Server 9.0 (all platforms)
* WebLogic Server 8.1 through service pack 5 (all platforms)
* WebLogic Server 7.0 through service pack 6 (all platforms)
* WebLogic Server 6.1 through service pack 7 (all platforms)

11) Passwords are echoed back to standard output when an administrator uses the "stopWebLogic.sh" script to shutdown a server.

The security issue affects the following versions:
* WebLogic Platform 8.1 through Service Pack 2 (on UNIX platforms)
* WebLogic Platform 7.0 through Service Pack 5 (on UNIX platforms)

Solution
Apply patches and service packs (see the original vendor advisories).
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
BEA06-133.00:
http://dev2dev.bea.com/pub/advisory/195

BEA06-132.00:
http://dev2dev.bea.com/pub/advisory/194

BEA06-131.00:
http://dev2dev.bea.com/pub/advisory/193

BEA06-130.00:
http://dev2dev.bea.com/pub/advisory/192

BEA06-129.00:
http://dev2dev.bea.com/pub/advisory/191

BEA06-128.00:
http://dev2dev.bea.com/pub/advisory/190

BEA06-127.00:
http://dev2dev.bea.com/pub/advisory/189

BEA06-126.00:
http://dev2dev.bea.com/pub/advisory/188

BEA06-125.00:
http://dev2dev.bea.com/pub/advisory/187

BEA06-124.00:
http://dev2dev.bea.com/pub/advisory/186

BEA06-121.00:
http://dev2dev.bea.com/pub/advisory/181

Deep Links
Links available in Customer Area