PT-2005-5430 · Bea · Bea Weblogic Server+1

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4767

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 7.0 SP6 and earlier, 8.1 SP5 and earlier

Description The issue allows remote attackers to guess the password more easily because it does not lock out a username after the maximum number of invalid login attempts when using username/password authentication.

Recommendations For versions 7.0 SP6 and earlier, and 8.1 SP5 and earlier, consider implementing a custom authentication mechanism to lock out usernames after a specified number of invalid login attempts as a temporary workaround. Restrict access to the authentication module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4767

Affected Products

Bea Weblogic Server

Weblogic Express

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-4767 · Security Note
• http://secunia.com/advisories/17138 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/161 · Vendor Advisory
• http://securityfocus.com/bid/15052 · Patch
• http://securityfocus.com/bid/17168 · Patch
• http://dev2dev.bea.com/pub/advisory/178 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4767 · Note