PT-2007-6597 · Oracle · Weblogic Enterprise+1

Publicado 2007-10-18 · Atualizado 2018-10-30 · CVE-2007-5576

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BEA Tuxedo versions 8.0 before RP392 BEA Tuxedo versions 8.1 before RP293 WebLogic Enterprise versions 5.1 before RP174

Description The issue allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands, as the password is echoed in cleartext.

Recommendations For BEA Tuxedo versions 8.0 before RP392, update to a version that includes RP392 or later to resolve the issue. For BEA Tuxedo versions 8.1 before RP293, update to a version that includes RP293 or later to resolve the issue. For WebLogic Enterprise versions 5.1 before RP174, update to a version that includes RP174 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-5576

Produtos afetados

Bea Tuxedo

Weblogic Enterprise

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5576 · Nota de Segurança
• http://osvdb.org/45478 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5576 · Nota
• http://dev2dev.bea.com/pub/advisory/226 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34290 · Nota
• http://vupen.com/english/advisories/2007/1813 · Nota