TITLE: BEA WebLogic Server/Express Multiple Security Issues SECUNIA ADVISORY ID: SA20130 VERIFY ADVISORY: http://secunia.com/advisories/20130/ CRITICAL: Less critical IMPACT: Security Bypass, Exposure of system information, Exposure of sensitive information WHERE: >From remote SOFTWARE: BEA WebLogic Server 9.x http://secunia.com/product/5822/ BEA WebLogic Server 8.x http://secunia.com/product/1360/ BEA WebLogic Server 7.x http://secunia.com/product/754/ BEA WebLogic Server 6.x http://secunia.com/product/753/ BEA WebLogic Express 9.x http://secunia.com/product/5823/ BEA WebLogic Express 8.x http://secunia.com/product/1843/ BEA WebLogic Express 7.x http://secunia.com/product/1282/ BEA WebLogic Express 6.x http://secunia.com/product/1281/ DESCRIPTION: Multiple security issues and a vulnerability have been reported in WebLogic Server / Express, which can be exploited by malicious people to disclose system and sensitive information, and bypass certain security restrictions. 1) Transactions are being sent over insecure channels for sites where JTA transactions are used over non-secure channels. The security issue affects the following versions: * WebLogic Server 8.1 through Service Pack 4 (all platforms) * WebLogic Server 7.0 through Service Pack 6 (all platforms) 2) An error caused due to the client connection manager not properly setting the Quality of Service on a channel in certain situations may cause some transaction coordinator messages to be sent over a non-SSL channel. The security issue affects the following version: * WebLogic Server 8.1 through Service Pack 3 (all platforms) 3) An error in the admin password reset mechanism may cause the admin password to be stored in clear-text in the domain directory. NOTE: This only affects sites which have been following certain instructions as described in BEA06-131.00. The security issue affects the following version: * WebLogic Server 8.1 4) An error in the handling of JavaServer Pages with compilation errors can be exploited to disclose the source code of ".jsp" files. The vulnerability affects the following versions: * WebLogic Server 8.1 through Service Pack 4 * WebLogic Server 7.0 through Service Pack 6 5) An error exists due to the internal server IP being disclosed when using the Administration Console to connect to the server. Successful exploitation requires administrative privileges. The security issue affects the following versions: * WebLogic Server 8.1 through Service Pack 4 * WebLogic Server 7.0 through Service Pack 6 * WebLogic Server 6.1 through Service Pack 7 6) The domain name is improperly displayed when accessing the login form of the Administration Console via HTTP/HTTPS. The security issue affects the following versions: * WebLogic Server 8.1 through service pack 4 (all platforms) * WebLogic Server 7.0 through service pack 6 (all platforms) 7) An error exists due to the username and password being logged in clear-text to the server log on an access failure when accessing protected JWS (Java Web Service) or web applications for sites that use WebLogic Server HTTP handlers. The security issue affects the following versions: * WebLogic Server 9.0 (all platforms) * WebLogic Server 8.1 through service pack 5 (all platforms) * WebLogic Server 7.0 through service pack 6 (all platforms) * WebLogic Server 6.1 through service pack 7 (all platforms) 8) The Administration Console does not set custom JDBC policies correctly, which may cause JDBC resources not being properly secured. The security issue affects the following version: * WebLogic Server 9.0 (all platforms) 9) Some errors exists where various internal network information may be improperly disclosed in certain situations. The security issues affect the following versions: * WebLogic Server 8.1 through service pack 4 (all platforms) * WebLogic Server 7.0 through service pack 6 (all platforms) * WebLogic Server 6.1 through service pack 7 (all platforms) 10) An error caused due to private keys not being properly protected can be exploited by malicious applications running on the server to disclose private keys. The security issue affects the following versions: * WebLogic Server 9.1 (all platforms) * WebLogic Server 9.0 (all platforms) * WebLogic Server 8.1 through service pack 5 (all platforms) * WebLogic Server 7.0 through service pack 6 (all platforms) * WebLogic Server 6.1 through service pack 7 (all platforms) 11) Passwords are echoed back to standard output when an administrator uses the "stopWebLogic.sh" script to shutdown a server. The security issue affects the following versions: * WebLogic Platform 8.1 through Service Pack 2 (on UNIX platforms) * WebLogic Platform 7.0 through Service Pack 5 (on UNIX platforms) SOLUTION: Apply patches and service packs (see the original vendor advisories). 3) The vendor recommends changing the administrator password via the console (see vendor advisory BEA06-131.00 for more information). PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: BEA06-133.00: http://dev2dev.bea.com/pub/advisory/195 BEA06-132.00: http://dev2dev.bea.com/pub/advisory/194 BEA06-131.00: http://dev2dev.bea.com/pub/advisory/193 BEA06-130.00: http://dev2dev.bea.com/pub/advisory/192 BEA06-129.00: http://dev2dev.bea.com/pub/advisory/191 BEA06-128.00: http://dev2dev.bea.com/pub/advisory/190 BEA06-127.00: http://dev2dev.bea.com/pub/advisory/189: BEA06-126.00: http://dev2dev.bea.com/pub/advisory/188 BEA06-125.00: http://dev2dev.bea.com/pub/advisory/187 BEA06-124.00: http://dev2dev.bea.com/pub/advisory/186 BEA06-121.00: http://dev2dev.bea.com/pub/advisory/181 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------