BEA WebLogic Keystore Clear Text Password Storage Vulnerability

Bugtraq ID:	6719
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 29 2003 12:00AM
Updated:	Jan 29 2003 12:00AM
Credit:	Vulnerability announced by BEA Systems.
Vulnerable:	BEA Systems WebLogic Server for Win32 7.0 .0.1 SP 1 BEA Systems WebLogic Server for Win32 7.0 .0.1 BEA Systems WebLogic Server for Win32 7.0 SP 1 BEA Systems WebLogic Server for Win32 7.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 BEA Systems Weblogic Server 7.0 .0.1 SP 1 BEA Systems Weblogic Server 7.0 .0.1 BEA Systems Weblogic Server 7.0 SP 1 BEA Systems Weblogic Server 7.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems WebLogic Express for Win32 7.0 .0.1 SP 1 BEA Systems WebLogic Express for Win32 7.0 .0.1 BEA Systems WebLogic Express for Win32 7.0 SP 1 BEA Systems WebLogic Express for Win32 7.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 BEA Systems WebLogic Express 7.0 .0.1 SP 1 BEA Systems WebLogic Express 7.0 .0.1 BEA Systems WebLogic Express 7.0 SP 1 BEA Systems WebLogic Express 7.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc
Not Vulnerable:

BEA WebLogic Keystore Clear Text Password Storage Vulnerability

It has been reported that BEA WebLogic servers are vulnerable to potential password recovery when keystores are used. In the event that an attacker could gain access to one of these keystores, it would be possible for the attacker to discover authentication information that could result in a potential compromise of communication integrity.

BEA WebLogic Keystore Clear Text Password Storage Vulnerability

No exploit is required for this vulnerability.

BEA WebLogic Keystore Clear Text Password Storage Vulnerability

Solution:
BEA has made fixes available. These fixes require upgrading to Service Pack 1 of the respective release chain prior to patch application. See the vendor web page reference for more details.


BEA Systems WebLogic Server for Win32 7.0 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Server for Win32 7.0 .0.1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express for Win32 7.0 .0.1 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Server for Win32 7.0

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express 7.0 .0.1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express for Win32 7.0 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems Weblogic Server 7.0 .0.1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express for Win32 7.0

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express for Win32 7.0 .0.1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express 7.0 .0.1 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems Weblogic Server 7.0 .0.1 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express 7.0

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Server for Win32 7.0 .0.1 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems Weblogic Server 7.0 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems Weblogic Server 7.0

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA Systems WebLogic Express 7.0 SP 1

• BEA Systems CR091911_70sp1.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR091911_70sp1.jar

BEA WebLogic Keystore Clear Text Password Storage Vulnerability

References:

• SECURITY ADVISORY (BEA03-25.00) (BEA Systems)