PT-2006-3420 · Bea · Bea Weblogic Server

Published 2006-05-19 · Updated 2017-07-20 · CVE-2006-2472

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 through SP7 BEA WebLogic Server versions 7.0 through SP6 BEA WebLogic Server versions 8.1 through SP5 BEA WebLogic Server version 9.0 BEA WebLogic Server version 9.1

Description The issue allows untrusted applications to obtain private server keys.

Recommendations For BEA WebLogic Server versions 6.1 through SP7, consider restricting access to private server keys until a fix is available. For BEA WebLogic Server versions 7.0 through SP6, consider restricting access to private server keys until a fix is available. For BEA WebLogic Server versions 8.1 through SP5, consider restricting access to private server keys until a fix is available. For BEA WebLogic Server version 9.0, consider restricting access to private server keys until a fix is available. For BEA WebLogic Server version 9.1, consider restricting access to private server keys until a fix is available.

Fix

Related Identifiers

CVE-2006-2472

Affected Products

Bea Weblogic Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-2472 · Security Note
• http://secunia.com/advisories/20130 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/186 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2472 · Note
• http://vupen.com/english/advisories/2006/1828 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26466 · Note
• http://securitytracker.com/id?1016095 · Note