PT-2007-5775 · Bea · Bea Weblogic Server

Publicado 2007-08-31 · Atualizado 2017-07-29 · CVE-2007-4615

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 7.0 SP7, 8.1 SP2 through 8.1 SP6, 9.0, 9.1, 9.2 Gold through 9.2 MP2, 10.0

Description The SSL client implementation in the affected software sometimes selects the null cipher when others are available. This could allow remote attackers to intercept communications.

Recommendations For BEA WebLogic Server version 7.0 SP7, update the SSL client configuration to avoid selecting the null cipher. For BEA WebLogic Server versions 8.1 SP2 through 8.1 SP6, update the SSL client configuration to avoid selecting the null cipher. For BEA WebLogic Server versions 9.0, 9.1, 9.2 Gold through 9.2 MP2, 10.0, update the SSL client configuration to avoid selecting the null cipher. As a temporary workaround, consider disabling the SSL client implementation until a patch is available. Restrict access to sensitive communications to minimize the risk of interception.

Correção

Identificadores relacionados

CVE-2007-4615

Produtos afetados

Bea Weblogic Server

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-4615 · Nota de Segurança
• http://vupen.com/english/advisories/2007/3008 · Nota
• http://secunia.com/advisories/26539 · Aviso do Fabricante
• http://dev2dev.bea.com/pub/advisory/244 · Aviso do Fabricante
• http://securityfocus.com/bid/25472 · Nota
• http://securitytracker.com/id?1018619 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4615 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36322 · Nota