PT-2006-3419 · Bea · Bea Weblogic Server

Publicado 2006-05-19 · Atualizado 2017-07-20 · CVE-2006-2471

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 through SP7 BEA WebLogic Server versions 7.0 through SP6 BEA WebLogic Server versions 8.1 through SP4

Description The issue allows remote attackers to obtain sensitive information, including DNS and IP addresses, internal sensitive information, server details in exceptions, and a stack trace in a SOAP fault. This is achieved through various means, such as interactions with T3 clients, the use of GetIORServlet, the provision of invalid XML, and the analysis of SOAP faults.

Recommendations For BEA WebLogic Server versions 6.1 through SP7, update to a version later than SP7 to resolve the issue. For BEA WebLogic Server versions 7.0 through SP6, update to a version later than SP6 to resolve the issue. For BEA WebLogic Server versions 8.1 through SP4, update to a version later than SP4 to resolve the issue.

Correção

Identificadores relacionados

CVE-2006-2471

Produtos afetados

Bea Weblogic Server

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26465 · Nota
• http://securitytracker.com/id?1016096 · Nota
• http://vupen.com/english/advisories/2006/1828 · Nota
• http://dev2dev.bea.com/pub/advisory/187 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2471 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2471 · Nota de Segurança
• http://secunia.com/advisories/20130 · Aviso do Fabricante