Vulnerability Note VU#920238

BEA WebLogic Server stores database password in clear text in "config.xml"

Original Release date: 19 Apr 2004 | Last revised: 19 Apr 2004

Overview

WebLogic Server contains a vulnerability that may expose the database username and password in clear text in the config.xml file.

Description

BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed Java applications." There is a vulnerability in the WebLogic Server that may expose the database username and password for untargeted JDBC connection pools. Under certain circumstances, the database username and password may be stored in clear text within the config.xml file.

According to the BEA Security Advisory, this vulnerability occurs under the following circumstances:

  • When a JDBC connection pool is not targeted to a server yet has a database username and password configured for it.
  • When a JDBC connection pool has been untargeted from all servers and has subsequently had the password changed.

The BEA Security Advisory states that the following versions of WebLogic Server and Express are affected by this vulnerability:
  • WebLogic Server and WebLogic Express version 8.1 through Service Pack 2, on all platforms
  • WebLogic Server and WebLogic Express version 7.0 through Service Pack 4, on all platforms
  • WebLogic Server and WebLogic Express version 6.1 through Service Pack 6, on all platforms

Impact

A user with access to the config.xml file may acquire the database username and password. The user could subsequently use this password to access the database.

Solution

Upgrade
BEA has released an advisory to address this issue. According to the BEA Security Advisory, it is recommended that users take the following action:

    WebLogic Server and WebLogic Express version 8.1

    1. Upgrade to WebLogic Server and WebLogic Express version 8.1 Service Pack 2.

    2. Install the patch from: ftp://ftpna.beasys.com/pub/releases/security/CR128888_81sp2.jar

    WebLogic Server version 8.1 Service Pack 3 will include the functionality in this patch.

    WebLogic Server and WebLogic Express version 7.0


    Upgrade to WebLogic Server and WebLogic Express version 7.0 Service Pack 5.

    WebLogic Server and WebLogic Express version 6.1


    1. Upgrade to WebLogic Server and WebLogic Express version 6.1 Service Pack 6

    2. Install the patch from: ftp://ftpna.beasys.com/pub/releases/security/CR128888_61sp6.jar

    WebLogic Server version 6.1 Service Pack 7 will include the functionality in this patch.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
BEA Systems Inc.Affected-19 Apr 2004
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported by BEA Systems Inc.

This document was written by Damon Morda.

Other Information

  • CVE IDs: Unknown
  • Date Public: 14 Apr 2004
  • Date First Published: 19 Apr 2004
  • Date Last Updated: 19 Apr 2004
  • Severity Metric: 5.94
  • Document Revision: 14

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.