PT-2007-5773 · Bea · Bea Weblogic Server

Published 2007-08-31 · Updated 2018-10-26 · CVE-2007-4613

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 Gold through SP7 BEA WebLogic Server versions 7.0 Gold through SP7 BEA WebLogic Server versions 8.1 Gold through SP5

Description The SSL libraries in the affected software might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack. This attack involves injecting crafted data and measuring the elapsed time before an error response.

Recommendations For BEA WebLogic Server versions 6.1 Gold through SP7, consider updating to a version that includes a fix for this issue. For BEA WebLogic Server versions 7.0 Gold through SP7, consider updating to a version that includes a fix for this issue. For BEA WebLogic Server versions 8.1 Gold through SP5, consider updating to a version that includes a fix for this issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2007-4613

Affected Products

Bea Weblogic Server

References · 5

• http://securityfocus.com/bid/22082 · Patch
• http://dev2dev.bea.com/pub/advisory/201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4613 · Security Note
• http://osvdb.org/45838 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4613 · Note