PT-2007-1882 · Bea · Bea Weblogic Server

Publicado 2007-01-23 · Atualizado 2011-03-08 · CVE-2007-0411

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 8.1 through 8.1 SP5 BEA WebLogic Server version 9.0 BEA WebLogic Server version 9.1 BEA WebLogic Server version 9.2 Gold

Description The issue allows remote attackers to conduct a man-in-the-middle (MITM) attack when WS-Security is used, due to improper validation of certificates.

Recommendations For BEA WebLogic Server versions 8.1 through 8.1 SP5, update the certificate validation process to properly verify certificates. For BEA WebLogic Server version 9.0, ensure that WS-Security is configured to validate certificates correctly. For BEA WebLogic Server version 9.1, verify that the certificate validation mechanism is enabled and properly configured. For BEA WebLogic Server version 9.2 Gold, check the WS-Security configuration to ensure it properly handles certificate validation.

Correção

Identificadores relacionados

CVE-2007-0411

Produtos afetados

Bea Weblogic Server

Referências · 8

• http://secunia.com/advisories/23750 · Nota
• http://dev2dev.bea.com/pub/advisory/205 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/0213 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0411 · Nota de Segurança
• http://securityfocus.com/bid/22082 · Nota
• http://osvdb.org/38503 · Nota
• http://securitytracker.com/id?1017525 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0411 · Nota