BEA WebLogic Server Null Cipher Suite Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	25472
Class:	Design Error
CVE:	CVE-2007-4616 CVE-2007-4615
Remote:	Yes
Local:	No
Published:	Aug 28 2007 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	The vendor disclosed these issues.
Vulnerable:	BEA Systems Weblogic Server 8.1 SP 6 BEA Systems Weblogic Server 8.1 SP 5 BEA Systems Weblogic Server 8.1 SP 4 BEA Systems Weblogic Server 8.1 SP 3 BEA Systems Weblogic Server 8.1 SP 2 BEA Systems Weblogic Server 7.0 SP 7 BEA Systems Weblogic Server 9.2 BEA Systems Weblogic Server 9.1 BEA Systems Weblogic Server 9.0 BEA Systems Weblogic Server 10.0 BEA Systems WebLogic Express 8.1 SP 5 BEA Systems WebLogic Express 8.1 SP 4 BEA Systems WebLogic Express 8.1 SP 3 BEA Systems WebLogic Express 8.1 SP 2 BEA Systems WebLogic Express 7.0 SP 7 BEA Systems WebLogic Express 8.1.0 SP 6
Not Vulnerable:

BEA WebLogic Server Null Cipher Suite Multiple Information Disclosure Vulnerabilities

BEA Weblogic Server is prone to multiple information-disclosure vulnerabilities due to a design error. This issue occurs when the application uses the default null cipher when encrypting data.

An attacker can exploit these issues to obtain sensitive information that may aid in further attacks.

BEA WebLogic Server Null Cipher Suite Multiple Information Disclosure Vulnerabilities

An attacker can exploit these issues by using standard network utilities.

BEA WebLogic Server Null Cipher Suite Multiple Information Disclosure Vulnerabilities

Solution:
BEA Systems released updates and advisories to address these issues. Updates for WebLogic Server 10.0, 9.2 and 9.1 can be obtained using the Smart Update Tool. Please see the references for details on how to obtain and install patches for other versions.


BEA Systems Weblogic Server 9.0

• BEA Systems CR319130_90_client.jar
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/CR319130_90_client.jar

BEA Systems WebLogic Express 8.1.0 SP 6

• BEA Systems CR319130_81sp6_client.jar
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/CR319130_81sp6_client.jar

BEA Systems Weblogic Server 7.0 SP 7

• BEA Systems CR325828_70sp7.jar
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/CR325828_70sp7.jar

BEA Systems Weblogic Server 8.1 SP 6

• BEA Systems CR319130_81sp6_client.jar
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/CR319130_81sp6_client.jar

BEA WebLogic Server Null Cipher Suite Multiple Information Disclosure Vulnerabilities

References:

• BEA WebLogic Express Homepage (BEA Systems)
  
• BEA WebLogic Server Homepage (BEA Systems)
  
• BEA Systems Security Advisory BEA07-175.00 (BEA Systems)
  
• BEA Systems Security Advisory BEA07-176.00 (BEA)