PT-2007-6597 · Oracle · Weblogic Enterprise+1

Published 2007-10-18 · Updated 2018-10-30 · CVE-2007-5576

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BEA Tuxedo versions 8.0 before RP392 BEA Tuxedo versions 8.1 before RP293 WebLogic Enterprise versions 5.1 before RP174

Description The issue allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands, as the password is echoed in cleartext.

Recommendations For BEA Tuxedo versions 8.0 before RP392, update to a version that includes RP392 or later to resolve the issue. For BEA Tuxedo versions 8.1 before RP293, update to a version that includes RP293 or later to resolve the issue. For WebLogic Enterprise versions 5.1 before RP174, update to a version that includes RP174 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-5576

Affected Products

Bea Tuxedo

Weblogic Enterprise

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5576 · Security Note
• http://dev2dev.bea.com/pub/advisory/226 · Vendor Advisory
• http://osvdb.org/45478 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5576 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34290 · Note
• http://vupen.com/english/advisories/2007/1813 · Note