PT-2005-5430 · Bea · Bea Weblogic Server+1

Publicado 2005-12-31 · Atualizado 2008-09-05 · CVE-2005-4767

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 7.0 SP6 and earlier, 8.1 SP5 and earlier

Description The issue allows remote attackers to guess the password more easily because it does not lock out a username after the maximum number of invalid login attempts when using username/password authentication.

Recommendations For versions 7.0 SP6 and earlier, and 8.1 SP5 and earlier, consider implementing a custom authentication mechanism to lock out usernames after a specified number of invalid login attempts as a temporary workaround. Restrict access to the authentication module to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-4767

Produtos afetados

Bea Weblogic Server

Weblogic Express

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-4767 · Nota de Segurança
• http://secunia.com/advisories/17138 · Aviso do Fabricante
• http://dev2dev.bea.com/pub/advisory/161 · Aviso do Fabricante
• http://securityfocus.com/bid/15052 · Correção
• http://securityfocus.com/bid/17168 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4767 · Nota
• http://dev2dev.bea.com/pub/advisory/178 · Aviso do Fabricante