PT-2007-5776 · Bea · Bea Weblogic Server

Published 2007-08-31 · Updated 2018-10-26 · CVE-2007-4616

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 7.0 Gold through SP7 BEA WebLogic Server versions 8.1 Gold through SP6 BEA WebLogic Server version 9.0 BEA WebLogic Server version 9.1 BEA WebLogic Server versions 9.2 Gold through MP1 BEA WebLogic Server version 10.0

Description The SSL server implementation in the affected software sometimes selects the null cipher when no other cipher is compatible between the server and client. This might allow remote attackers to intercept communications.

Recommendations For BEA WebLogic Server versions 7.0 Gold through SP7, update to a version that selects a secure cipher by default. For BEA WebLogic Server versions 8.1 Gold through SP6, update to a version that selects a secure cipher by default. For BEA WebLogic Server version 9.0, update to a version that selects a secure cipher by default. For BEA WebLogic Server version 9.1, update to a version that selects a secure cipher by default. For BEA WebLogic Server versions 9.2 Gold through MP1, update to a version that selects a secure cipher by default. For BEA WebLogic Server version 10.0, update to a version that selects a secure cipher by default.

Fix

Related Identifiers

CVE-2007-4616

Affected Products

Bea Weblogic Server

References · 8

• http://secunia.com/advisories/26539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4616 · Security Note
• http://vupen.com/english/advisories/2007/3008 · Note
• http://securitytracker.com/id?1018620 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4616 · Note
• http://securityfocus.com/bid/25472 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36320 · Note
• http://dev2dev.bea.com/pub/advisory/245 · Patch, Vendor Advisory