PT-2009-3598 · Bea+1 · Bea Weblogic Server+2

Published 2009-04-15 · Updated 2025-09-08 · CVE-2009-1016

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BEA Product Suite versions 7.0 SP7 through 10.3 BEA WebLogic Server version 8.1 SP6 BEA WebLogic Server versions 9.0 through 9.2 MP3

Description The issue affects confidentiality, integrity, and availability, and is related to IIS. It may involve a stack-based buffer overflow related to an unspecified Server Plug-in and a crafted SSL certificate.

Recommendations For BEA Product Suite versions 7.0 SP7 through 10.3, consider restricting access to the Server Plug-in to minimize the risk of exploitation. For BEA WebLogic Server version 8.1 SP6, avoid using crafted SSL certificates until the issue is resolved. For BEA WebLogic Server versions 9.0 through 9.2 MP3, as a temporary workaround, consider disabling the use of SSL certificates in the Server Plug-in until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2009-1016

Affected Products

Bea Product Suite

Bea Weblogic Server

Iis

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2009-1016 · Security Note
• http://securitytracker.com/id?1022059 · Note
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Note
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64934 · Note
• http://securityfocus.com/bid/34461 · Note
• http://secunia.com/secunia_research/2009-23 · Note