PT-2007-5776 · Bea · Bea Weblogic Server

Publicado 2007-08-31 · Atualizado 2018-10-26 · CVE-2007-4616

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 7.0 Gold through SP7 BEA WebLogic Server versions 8.1 Gold through SP6 BEA WebLogic Server version 9.0 BEA WebLogic Server version 9.1 BEA WebLogic Server versions 9.2 Gold through MP1 BEA WebLogic Server version 10.0

Description The SSL server implementation in the affected software sometimes selects the null cipher when no other cipher is compatible between the server and client. This might allow remote attackers to intercept communications.

Recommendations For BEA WebLogic Server versions 7.0 Gold through SP7, update to a version that selects a secure cipher by default. For BEA WebLogic Server versions 8.1 Gold through SP6, update to a version that selects a secure cipher by default. For BEA WebLogic Server version 9.0, update to a version that selects a secure cipher by default. For BEA WebLogic Server version 9.1, update to a version that selects a secure cipher by default. For BEA WebLogic Server versions 9.2 Gold through MP1, update to a version that selects a secure cipher by default. For BEA WebLogic Server version 10.0, update to a version that selects a secure cipher by default.

Correção

Identificadores relacionados

CVE-2007-4616

Produtos afetados

Bea Weblogic Server

Referências · 8

• http://vupen.com/english/advisories/2007/3008 · Nota
• http://securitytracker.com/id?1018620 · Nota
• http://secunia.com/advisories/26539 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4616 · Nota
• http://securityfocus.com/bid/25472 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36320 · Nota
• http://dev2dev.bea.com/pub/advisory/245 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4616 · Nota de Segurança