BEA WebLogic Internal Servlet Input Validation Vulnerabilities

Bugtraq ID:	7122
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 17 2003 12:00AM
Updated:	Mar 17 2003 12:00AM
Credit:	Discovery is credited to "Lluis Mora" <[email protected]>.
Vulnerable:	BEA Systems Weblogic Server 7.0 SP 2 BEA Systems Weblogic Server 7.0 SP 1 BEA Systems Weblogic Server 7.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems Weblogic Server 6.1 SP 4 BEA Systems Weblogic Server 6.1 SP 3 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems Weblogic Server 6.1 SP 2 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems Weblogic Server 6.1 SP 1 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems Weblogic Server 6.1 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems Weblogic Server 6.0 SP 2 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Redhat Linux 5.1 - Sun Solaris 8_sparc BEA Systems Weblogic Server 6.0 SP 1 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Redhat Linux 5.1 - Sun Solaris 8_sparc BEA Systems Weblogic Server 6.0 - Apache Apache 1.3.12 - Apache Apache 1.3.9 - Apache Apache 1.3.9 - C2Net StrongHold Web Server 3.0 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft IIS 5.0 - Microsoft IIS 4.0 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Redhat Linux 5.1 - Sun Solaris 8_sparc
Not Vulnerable:

BEA WebLogic Internal Servlet Input Validation Vulnerabilities

Input validation issues have been reported in a WebLogic internal servlet that is used by the web management interface. Unauthenticated users may exploit these issues in the internal servlet to upload malicious files to a host running the vulnerable software or disclose the contents of sensitive files. This could result in execution of arbitrary commands or other attacks.

These issues were reported to affect BEA WebLogic Server. BEA WebLogic Express may also be affected, so users of WebLogic Express are also advised to apply the provided patches.

BEA WebLogic Internal Servlet Input Validation Vulnerabilities

There is no exploit required.

BEA WebLogic Internal Servlet Input Validation Vulnerabilities

Solution:
BEA Systems has released fixes which address this issue. Further instructions on applying fixes may be found in the attached BEA advisory.


BEA Systems Weblogic Server 6.0 SP 2

• BEA Systems CR096950_60sp2rp3.zip
  WebLogic Server and Express 6.0 Service Pack 2 Rolling Patch 3 for Windows.
  ftp://ftpna.beasys.com/pub/releases/security/CR096950_60sp2rp3.zip

BEA Systems Weblogic Server 6.1 SP 4

• BEA Systems CR096950_61sp4.zip
  WebLogic Server and Express 6.1 Service Pack 4 patch for Windows.
  ftp://ftpna.beasys.com/pub/releases/security/CR096950_61sp4.zip

BEA Systems Weblogic Server 7.0 SP 2

• BEA Systems CR096950_70sp2.zip
  WebLogic Server and Express 7.0/7.0.0.1 Service Pack 2 patch for Windows.
  ftp://ftpna.beasys.com/pub/releases/security/CR096950_70sp2.zip

BEA WebLogic Internal Servlet Input Validation Vulnerabilities

References:

• SECURITY ADVISORY (BEA03-28.00) (BEA Systems)
  
• S21SEC-011 - Multiple vulnerabilities in BEA WebLogic Server ("Lluis Mora" )