PT-2007-5775 · Bea · Bea Weblogic Server

Published 2007-08-31 · Updated 2017-07-29 · CVE-2007-4615

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 7.0 SP7, 8.1 SP2 through 8.1 SP6, 9.0, 9.1, 9.2 Gold through 9.2 MP2, 10.0

Description The SSL client implementation in the affected software sometimes selects the null cipher when others are available. This could allow remote attackers to intercept communications.

Recommendations For BEA WebLogic Server version 7.0 SP7, update the SSL client configuration to avoid selecting the null cipher. For BEA WebLogic Server versions 8.1 SP2 through 8.1 SP6, update the SSL client configuration to avoid selecting the null cipher. For BEA WebLogic Server versions 9.0, 9.1, 9.2 Gold through 9.2 MP2, 10.0, update the SSL client configuration to avoid selecting the null cipher. As a temporary workaround, consider disabling the SSL client implementation until a patch is available. Restrict access to sensitive communications to minimize the risk of interception.

Fix

Related Identifiers

CVE-2007-4615

Affected Products

Bea Weblogic Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-4615 · Security Note
• http://secunia.com/advisories/26539 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/244 · Vendor Advisory
• http://vupen.com/english/advisories/2007/3008 · Note
• http://securityfocus.com/bid/25472 · Note
• http://securitytracker.com/id?1018619 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4615 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36322 · Note