PT-2005-5370 · Bea · Oracle Weblogic Server+1

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4705

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 8.1 through SP4 BEA WebLogic Server and WebLogic Express versions 7.0 through SP6 BEA WebLogic Server and WebLogic Express versions 6.1 through SP7

Description The issue allows remote attackers to sniff the connection when a Java client application creates an SSL connection to the server after it has already created an insecure connection. This is because the server will use the insecure connection instead of the secure one.

Recommendations For versions 8.1 through SP4, ensure that the client application does not create an insecure connection before establishing an SSL connection. For versions 7.0 through SP6, restrict the use of insecure connections to minimize the risk of exploitation. For versions 6.1 through SP7, consider disabling the reuse of existing connections to force the creation of a new secure connection.

Fix

Related Identifiers

CVE-2005-4705

Affected Products

Weblogic Express

Oracle Weblogic Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4705 · Security Note
• http://osvdb.org/20095 · Patch
• http://dev2dev.bea.com/pub/advisory/141 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4705 · Note