PT-2004-2660 · Bea · Bea Weblogic Server+1

Published 2004-04-13 · Updated 2017-07-11 · CVE-2004-1756

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 8.1 SP2 and earlier BEA WebLogic Server and WebLogic Express versions 7.0 SP4 and earlier

Description The issue allows remote attackers to spoof other users or servers when using 2-way SSL with a custom trust manager. This occurs because the server may accept a certificate chain even if the trust manager rejects it.

Recommendations For versions 8.1 SP2 and earlier, consider disabling the use of custom trust managers with 2-way SSL until a fix is available. For versions 7.0 SP4 and earlier, consider disabling the use of custom trust managers with 2-way SSL until a fix is available.

Fix

Related Identifiers

CVE-2004-1756

Affected Products

Bea Weblogic Server

Weblogic Express

References · 8

• http://securityfocus.com/bid/10132 · Vendor Advisory
• http://kb.cert.org/vuls/id/566390 · Patch
• http://secunia.com/advisories/11358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1756 · Security Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp · Vendor Advisory
• http://securitytracker.com/id?1009765 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1756 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15862 · Note