Vulnerability Note VU#566390
BEA WebLogic Server fails to properly validate certificate chains
There is a vulnerability in BEA WebLogic Server in which certificate chains rejected by the custom trust manager could still be accepted by the server.
BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed Java applications." The WebLogic Server allows for the configuration of custom trust managers. This feature provides the ability to override certain validation errors when evaluating a client's certificate. There is a vulnerability in the way the WebLogic server validates certificate chains that could allow a remote attacker to impersonate a user or remote server.
According to the BEA Security Advisory,
The BEA Security Advisory states that the following versions of WebLogic Server and Express are affected by this vulnerability:
A remote attacker could impersonate a user or remote server.
1. Upgrade to WebLogic Server and WebLogic Express version 8.1 Service Pack 2.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|BEA Systems Inc.||Affected||-||22 Apr 2004|
CVSS Metrics (Learn More)
This vulnerability was reported by BEA Systems Inc.
This document was written by Damon Morda.
- CVE IDs: Unknown
- Date Public: 14 Apr 2004
- Date First Published: 22 Apr 2004
- Date Last Updated: 22 Apr 2004
- Severity Metric: 5.20
- Document Revision: 16
If you have feedback, comments, or additional information about this vulnerability, please send us email.