PT-2004-2660 · Bea · Bea Weblogic Server+1

Publicado 2004-04-13 · Atualizado 2017-07-11 · CVE-2004-1756

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 8.1 SP2 and earlier BEA WebLogic Server and WebLogic Express versions 7.0 SP4 and earlier

Description The issue allows remote attackers to spoof other users or servers when using 2-way SSL with a custom trust manager. This occurs because the server may accept a certificate chain even if the trust manager rejects it.

Recommendations For versions 8.1 SP2 and earlier, consider disabling the use of custom trust managers with 2-way SSL until a fix is available. For versions 7.0 SP4 and earlier, consider disabling the use of custom trust managers with 2-way SSL until a fix is available.

Correção

Identificadores relacionados

CVE-2004-1756

Produtos afetados

Bea Weblogic Server

Weblogic Express

Referências · 8

• http://securityfocus.com/bid/10132 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1756 · Nota
• http://kb.cert.org/vuls/id/566390 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15862 · Nota
• http://secunia.com/advisories/11358 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1756 · Nota de Segurança
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp · Aviso do Fabricante
• http://securitytracker.com/id?1009765 · Aviso do Fabricante