PT-2006-3419 · Bea · Bea Weblogic Server

Published 2006-05-19 · Updated 2017-07-20 · CVE-2006-2471

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 through SP7 BEA WebLogic Server versions 7.0 through SP6 BEA WebLogic Server versions 8.1 through SP4

Description The issue allows remote attackers to obtain sensitive information, including DNS and IP addresses, internal sensitive information, server details in exceptions, and a stack trace in a SOAP fault. This is achieved through various means, such as interactions with T3 clients, the use of GetIORServlet, the provision of invalid XML, and the analysis of SOAP faults.

Recommendations For BEA WebLogic Server versions 6.1 through SP7, update to a version later than SP7 to resolve the issue. For BEA WebLogic Server versions 7.0 through SP6, update to a version later than SP6 to resolve the issue. For BEA WebLogic Server versions 8.1 through SP4, update to a version later than SP4 to resolve the issue.

Fix

Related Identifiers

CVE-2006-2471

Affected Products

Bea Weblogic Server

References · 7

• http://dev2dev.bea.com/pub/advisory/187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2471 · Security Note
• http://secunia.com/advisories/20130 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26465 · Note
• http://securitytracker.com/id?1016096 · Note
• http://vupen.com/english/advisories/2006/1828 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2471 · Note