PT-2007-5773 · Bea · Bea Weblogic Server

Publicado 2007-08-31 · Atualizado 2018-10-26 · CVE-2007-4613

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 Gold through SP7 BEA WebLogic Server versions 7.0 Gold through SP7 BEA WebLogic Server versions 8.1 Gold through SP5

Description The SSL libraries in the affected software might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack. This attack involves injecting crafted data and measuring the elapsed time before an error response.

Recommendations For BEA WebLogic Server versions 6.1 Gold through SP7, consider updating to a version that includes a fix for this issue. For BEA WebLogic Server versions 7.0 Gold through SP7, consider updating to a version that includes a fix for this issue. For BEA WebLogic Server versions 8.1 Gold through SP5, consider updating to a version that includes a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2007-4613

Produtos afetados

Bea Weblogic Server

Referências · 5

• http://securityfocus.com/bid/22082 · Correção
• http://osvdb.org/45838 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4613 · Nota
• http://dev2dev.bea.com/pub/advisory/201 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4613 · Nota de Segurança