PT-2007-1892 · Bea · Bea Weblogic Server

Published 2007-01-23 · Updated 2018-10-17 · CVE-2007-0421

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 through 6.1 SP7 BEA WebLogic Server versions 7.0 through 7.0 SP7

Description The issue allows remote attackers to cause a denial of service, specifically disk consumption, by sending requests with malformed headers. This results in a large amount of data being written to the server log.

Recommendations For BEA WebLogic Server versions 6.1 through 6.1 SP7, consider restricting access to prevent malicious requests until a fix is available. For BEA WebLogic Server versions 7.0 through 7.0 SP7, consider implementing logging limits to prevent disk consumption from large log files.

Fix

Related Identifiers

CVE-2007-0421

Affected Products

Bea Weblogic Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-0421 · Security Note
• http://dev2dev.bea.com/pub/advisory/215 · Vendor Advisory
• http://secunia.com/advisories/23750 · Note
• http://vupen.com/english/advisories/2007/0213 · Note
• http://securityfocus.com/bid/22082 · Note
• http://osvdb.org/32859 · Note
• http://securitytracker.com/id?1017525 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0421 · Note