BEA WebLogic Server And WebLogic Express Application Role Unauthorized Access Vulnerability

Bugtraq ID:	10624
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 29 2004 12:00AM
Updated:	Jun 29 2004 12:00AM
Credit:	The individual responsible for discovery of this issue is currently unknown; this issue was disclosed in the referenced BEA advisory.
Vulnerable:	BEA Systems WebLogic Server for Win32 8.1 SP 2 BEA Systems WebLogic Server for Win32 8.1 SP 1 BEA Systems WebLogic Server for Win32 8.1 BEA Systems WebLogic Server for Win32 7.0 SP 5 BEA Systems WebLogic Server for Win32 7.0 SP 4 BEA Systems WebLogic Server for Win32 7.0 SP 3 BEA Systems WebLogic Server for Win32 7.0 SP 2 BEA Systems WebLogic Server for Win32 7.0 SP 1 BEA Systems WebLogic Server for Win32 7.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 BEA Systems Weblogic Server 8.1 SP 2 BEA Systems Weblogic Server 8.1 SP 1 BEA Systems Weblogic Server 8.1 BEA Systems Weblogic Server 7.0 SP 5 BEA Systems Weblogic Server 7.0 SP 4 BEA Systems Weblogic Server 7.0 SP 3 BEA Systems Weblogic Server 7.0 SP 2 BEA Systems Weblogic Server 7.0 SP 1 BEA Systems Weblogic Server 7.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems WebLogic Express for Win32 8.1 SP 2 BEA Systems WebLogic Express for Win32 8.1 SP 1 BEA Systems WebLogic Express for Win32 8.1 BEA Systems WebLogic Express for Win32 7.0 SP 5 BEA Systems WebLogic Express for Win32 7.0 SP 4 BEA Systems WebLogic Express for Win32 7.0 SP 3 BEA Systems WebLogic Express for Win32 7.0 SP 2 BEA Systems WebLogic Express for Win32 7.0 SP 1 BEA Systems WebLogic Express for Win32 7.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 BEA Systems WebLogic Express 8.1 SP 2 BEA Systems WebLogic Express 8.1 SP 1 BEA Systems WebLogic Express 8.1 BEA Systems WebLogic Express 7.0 SP 5 BEA Systems WebLogic Express 7.0 SP 4 BEA Systems WebLogic Express 7.0 SP 3 BEA Systems WebLogic Express 7.0 SP 2 BEA Systems WebLogic Express 7.0 SP 1 BEA Systems WebLogic Express 7.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc
Not Vulnerable:	BEA Systems WebLogic Server for Win32 8.1 SP 3 BEA Systems Weblogic Server 8.1 SP 3 BEA Systems WebLogic Express for Win32 8.1 SP 3 BEA Systems WebLogic Express 8.1 SP 3

BEA WebLogic Server And WebLogic Express Application Role Unauthorized Access Vulnerability

WebLogic Server And WebLogic Express are affected by a vulnerability that may unauthorized access to application roles. This issue is due to a failure of the application to properly implement the Servlet 2.3 specification, facilitating unauthorized access.

It should be noted that this issue only arises when a web application is built using the '*' specifier within the '<role-name>' tags, resources are defined to be protected by the '*' specifier, and users exist without explicitly defined roles. Due to the circumstantial nature of this issue, exploitation may be unlikely.

This issue would allow an attacker to carry out actions outside of the defined roles; potentially leading to unauthorized access or other attacks.

BEA WebLogic Server And WebLogic Express Application Role Unauthorized Access Vulnerability

No exploit is required to leverage this issue.

BEA WebLogic Server And WebLogic Express Application Role Unauthorized Access Vulnerability

Solution:
BEA Systems has released advisory BEA04-64.00 dealing with this issue. Please see the referenced advisory for more information.


BEA Systems WebLogic Express 7.0 SP 2

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems Weblogic Server 7.0 SP 3

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems Weblogic Server 7.0 SP 4

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express for Win32 7.0 SP 1

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express 7.0 SP 5

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Server for Win32 7.0 SP 3

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express 7.0

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express for Win32 7.0 SP 3

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express for Win32 7.0 SP 4

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems Weblogic Server 7.0 SP 2

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems Weblogic Server 7.0

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Server for Win32 7.0 SP 4

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Server for Win32 7.0 SP 1

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Server for Win32 7.0

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems Weblogic Server 7.0 SP 5

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express for Win32 7.0

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express 7.0 SP 3

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express for Win32 7.0 SP 2

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems Weblogic Server 7.0 SP 1

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Server for Win32 7.0 SP 5

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Server for Win32 7.0 SP 2

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express for Win32 7.0 SP 5

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express 7.0 SP 4

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems WebLogic Express 7.0 SP 1

• BEA Systems CR175310_700sp5.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_700sp5.jar

BEA Systems Weblogic Server 8.1 SP 1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems Weblogic Server 8.1 SP 2

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Server for Win32 8.1 SP 2

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Server for Win32 8.1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems Weblogic Server 8.1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Express for Win32 8.1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Express for Win32 8.1 SP 1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Express 8.1 SP 2

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Server for Win32 8.1 SP 1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Express 8.1 SP 1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Express for Win32 8.1 SP 2

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA Systems WebLogic Express 8.1

• BEA Systems CR175310_810sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR175310_810sp2.jar

BEA WebLogic Server And WebLogic Express Application Role Unauthorized Access Vulnerability

References:

• Security Advisory: (BEA04-64.00) (BEA Systems)
  
• Weblogic (BEA Systems)