PT-2006-1486 · Bea · Bea Weblogic Server+1

Publicado 2006-01-25 · Atualizado 2008-09-05 · CVE-2006-0419

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 7.0 through SP6 BEA WebLogic Server and WebLogic Express versions 8.1 through SP5 BEA WebLogic Server and WebLogic Express version 9.0

Description The issue allows anonymous binds to the embedded LDAP server. This enables remote attackers to read user entries or cause a denial of service by establishing a large number of connections.

Recommendations For BEA WebLogic Server and WebLogic Express version 9.0, restrict access to the embedded LDAP server to prevent anonymous binds. For BEA WebLogic Server and WebLogic Express versions 8.1 through SP5, limit the number of connections to the embedded LDAP server to prevent denial of service. For BEA WebLogic Server and WebLogic Express versions 7.0 through SP6, consider disabling anonymous access to the embedded LDAP server until a fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-0419

Produtos afetados

Bea Weblogic Server

Weblogic Express

Referências · 4

• 🔥 http://dev2dev.bea.com/pub/advisory/163 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0419 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0419 · Nota
• http://securitytracker.com/id?1015528 · Correção