Vulnerability Note VU#920238

BEA WebLogic Server stores database password in clear text in "config.xml"

Overview

WebLogic Server contains a vulnerability that may expose the database username and password in clear text in the config.xml file.

I. Description

BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed Java applications." There is a vulnerability in the WebLogic Server that may expose the database username and password for untargeted JDBC connection pools. Under certain circumstances, the database username and password may be stored in clear text within the config.xml file.

According to the BEA Security Advisory, this vulnerability occurs under the following circumstances:

When a JDBC connection pool is not targeted to a server yet has a database username and password configured for it.
When a JDBC connection pool has been untargeted from all servers and has subsequently had the password changed.

The BEA Security Advisory states that the following versions of WebLogic Server and Express are affected by this vulnerability:

WebLogic Server and WebLogic Express version 8.1 through Service Pack 2, on all platforms
WebLogic Server and WebLogic Express version 7.0 through Service Pack 4, on all platforms
WebLogic Server and WebLogic Express version 6.1 through Service Pack 6, on all platforms

II. Impact

A user with access to the config.xml file may acquire the database username and password. The user could subsequently use this password to access the database.

III. Solution

Upgrade

BEA has released an advisory to address this issue. According to the BEA Security Advisory, it is recommended that users take the following action:

WebLogic Server and WebLogic Express version 8.1

ftp://ftpna.beasys.com/pub/releases/security/CR128888_81sp2.jar

WebLogic Server and WebLogic Express version 7.0

WebLogic Server and WebLogic Express version 6.1

ftp://ftpna.beasys.com/pub/releases/security/CR128888_61sp6.jar

Systems Affected

Vendor	Status	Date Notified	Date Updated
BEA Systems Inc.	Vulnerable	19-Apr-2004

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp
http://secunia.com/advisories/11357/
http://securitytracker.com/alerts/2004/Apr/1009764.html
http://edocs.bea.com/wls/docs61/adminguide/jdbc.html#1097203
http://edocs.bea.com/wls/docs61/jdbc/programming.html#programming001

Credit

This vulnerability was reported by BEA Systems Inc.

This document was written by Damon Morda.

Other Information

Date Public:	2004-04-14
Date First Published:	2004-04-19
Date Last Updated:	2004-04-19
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	5.94
Document Revision:	14

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader