BEA Systems WebLogic Access Controls Bypass Vulnerability

Bugtraq ID:	5089
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 21 2002 12:00AM
Updated:	Jun 21 2002 12:00AM
Credit:	Published in BEA Systems Security Advisory BEA00-06.00.
Vulnerable:	BEA Systems Weblogic Server 5.1 SP 6 BEA Systems Weblogic Server 5.1 SP 5 BEA Systems Weblogic Server 5.1 SP 4 BEA Systems Weblogic Server 5.1 SP 3 BEA Systems Weblogic Server 5.1 SP 2 BEA Systems Weblogic Server 5.1 SP 1 BEA Systems Weblogic Server 5.1 - Apache Apache 1.3.12 - Apache Apache 1.3.9 - Apache Apache 1.3.9 - C2Net StrongHold Web Server 3.0 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft IIS 5.0 - Microsoft IIS 4.0 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Redhat Linux 5.1 - Sun Solaris 8_sparc BEA Systems WebLogic Express 5.1 SP 6 BEA Systems WebLogic Express 5.1 SP 5 BEA Systems WebLogic Express 5.1 SP 4 BEA Systems WebLogic Express 5.1 SP 3 BEA Systems WebLogic Express 5.1 SP 2 BEA Systems WebLogic Express 5.1 SP 1 BEA Systems WebLogic Express 5.1
Not Vulnerable:	BEA Systems Weblogic Server 5.1 SP 7 - Digital OpenVMS 7.1 - Digital (Compaq) TRU64/DIGITAL UNIX 5.0 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3 - IBM AIX 4.2 - IBM OS/390 V2R6 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Redhat Linux 7.0 - SCO Unixware 7.1.1 - SGI IRIX 6.5.8 - Sun Solaris 8_sparc BEA Systems WebLogic Express 5.1 SP 7

BEA Systems WebLogic Access Controls Bypass Vulnerability

Solution:
This issues is resolved in WebLogin 5.1 Service Pack 7. A patch is available for Service Pack 6:


BEA Systems Weblogic Server 5.1 SP 6

• BEA Systems SecurityBEA00-0600.zip
  ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip

BEA Systems WebLogic Express 5.1 SP 6

• BEA Systems SecurityBEA00-0600.zip
  ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip

BEA Systems WebLogic Access Controls Bypass Vulnerability

References:

• SECURITY ADVISORY (BEA00-06.00) (BEA Systems)