BEA WebLogic Server code execution paths may cause the current user to be incorrect

2003-08-05T00:00:00
ID VU:999788
Type cert
Reporter CERT
Modified 2003-08-05T00:00:00

Description

Overview

A vulnerability in BEA WebLogic Server and Express may allow a local attacker to gain elevated privileges.

Description

BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed Java applications." A vulnerability in BEA WebLogic Server and Express may allow a local attacker to gain elevated privileges. Quoting from BEA03-35.00:

Certain code execution paths can cause the current user to be incorrect. This is most likely to happen when JNDI initial contexts are used repeatedly to log users in but can even occur in programs that never explicitly execute a login.


Impact

A local attacker may be able to gain elevated privileges.


Solution

Apply a patch. BEA Systems also notes "When Service Pack 4 is available, you can use that Service Pack instead of this patch."


Systems Affected

Vendor| Status| Date Notified| Date Updated
---|---|---|---
BEA Systems Inc.| | -| 05 Aug 2003
If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A

References

  • <http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp>
  • <ftp://ftpna.beasys.com/pub/releases/security/CR110892_700sp3.jar>
  • <http://www.bea.com/products/weblogic/server/index.shtml>
  • <http://www.secunia.com/advisories/9400/>

Credit

Thanks to BEA Systems for reporting this vulnerability.

This document was written by Ian A Finlay.

Other Information

  • CVE IDs: Unknown
  • Date Public: 31 Jul 2003
  • Date First Published: 05 Aug 2003
  • Date Last Updated: 05 Aug 2003
  • Severity Metric: 5.91
  • Document Revision: 5