PT-2005-5428 · Bea · Bea Weblogic Server+1

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4765

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier BEA WebLogic Server and WebLogic Express versions 7.0 SP6 and earlier

Description The issue arises when using the weblogic.Deployer command with the t3 protocol. Even when an Administration port is enabled on the Administration server, the secure t3s protocol is not used, which might allow remote attackers to sniff the connection.

Recommendations For BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, consider using the secure t3s protocol instead of t3 when deploying with the weblogic.Deployer command. For BEA WebLogic Server and WebLogic Express versions 7.0 SP6 and earlier, consider using the secure t3s protocol instead of t3 when deploying with the weblogic.Deployer command.

Fix

Related Identifiers

CVE-2005-4765

Affected Products

Bea Weblogic Server

Weblogic Express

References · 5

• http://secunia.com/advisories/17138 · Vendor Advisory
• http://securityfocus.com/bid/15052 · Patch
• http://dev2dev.bea.com/pub/advisory/156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4765 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4765 · Note