CVE-2004-2696
CVSS5.5
发布时间 :2004-12-31 00:00:00
修订时间 :2008-09-05 00:00:00
NMCO    

[原文]BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in an RMI call.


[CNNVD]BEA WebLogic Server/WebLogic Express Java RMI不正确会话继承漏洞(CNNVD-200412-1086)

        
        BEA Systems WebLogic包含多种应用系统集成方案,包括Server/Express/Integration等。
        BEA WebLogic的对Java Remote Method Invocation (RMI)文档描述存在问题,遵从此文档开发的产品可导致权限提升问题。
        问题发生在当客户多次以不同用户登录WebLogic服务器时,文档描述客户的行为是:当RMI请求提交时是没有当前用户关联客户线程的,这对RMI通过T3协议来说是正确的,但针对RMI通过IIOP协议走的情况下是不正确的,任意依赖此文档描述的行为可导致在RMI调用中获得其他用户的验证信息。
        

- CVSS (基础分值)

CVSS分值: 5.5 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: SINGLE_INSTANCE [--]

- CWE (弱点类目)

CWE-255 [凭证管理]

- CPE (受影响的平台与产品)

cpe:/a:bea:weblogic_server:6.1:sp1BEA Systems WebLogic Server 6.1 SP1
cpe:/a:bea:weblogic_server:7.0:sp2
cpe:/a:bea:weblogic_server:7.0.0.1BEA Systems WebLogic Server 7.0.0.1
cpe:/a:bea:weblogic_server:6.1:sp6BEA Systems WebLogic Server 6.1 SP6
cpe:/a:bea:weblogic_server:7.0.0.1:sp4:expressBEA Systems WebLogic Express 7.0.0.1 SP4
cpe:/a:bea:weblogic_server:8.1:sp1:win32BEA Systems WebLogic Server 8.1 SP1 Win32
cpe:/a:bea:weblogic_server:7.0:sp5:express
cpe:/a:bea:weblogic_server:6.1:sp3:win32BEA Systems WebLogic Server 6.1 SP3 Win32
cpe:/a:bea:weblogic_server:6.1:sp4:win32BEA Systems WebLogic Server 6.1 SP4 Win32
cpe:/a:bea:weblogic_server:7.0.0.1:sp1BEA Systems WebLogic Server 7.0.0.1 SP1
cpe:/a:bea:weblogic_server:6.1:sp3:expressBEA Systems WebLogic Express 6.1 SP3
cpe:/a:bea:weblogic_server:7.0.0.1:sp2:expressBEA Systems WebLogic Express 7.0.0.1 SP2
cpe:/a:bea:weblogic_server:7.0:sp2:win32
cpe:/a:bea:weblogic_server:7.0.0.1::express
cpe:/a:bea:weblogic_server:7.0:sp4:express
cpe:/a:bea:weblogic_server:7.0:sp1
cpe:/a:bea:weblogic_server:7.0BEA Systems WebLogic Server 7.0
cpe:/a:bea:weblogic_server:7.0:sp1:win32
cpe:/a:bea:weblogic_server:6.1BEA Systems WebLogic Server 6.1
cpe:/a:bea:weblogic_server:8.1:sp2:win32BEA Systems WebLogic Server 8.1 SP2 Win32
cpe:/a:bea:weblogic_server:6.1:sp5:expressBEA Systems WebLogic Express 6.1 SP5
cpe:/a:bea:weblogic_server:7.0.0.1::win32
cpe:/a:bea:weblogic_server:6.1:sp1:win32BEA Systems WebLogic Server 6.1 SP1 Win32
cpe:/a:bea:weblogic_server:7.0.0.1:sp3:expressBEA Systems WebLogic Express 7.0.0.1 SP3
cpe:/a:bea:weblogic_server:6.1:sp5BEA Systems WebLogic Server 6.1 SP5
cpe:/a:bea:weblogic_server:7.0:sp4:win32
cpe:/a:bea:weblogic_server:6.1:sp4BEA Systems WebLogic Server 6.1 SP4
cpe:/a:bea:weblogic_server:7.0::win32
cpe:/a:bea:weblogic_server:8.1:sp1:expressBEA Systems WebLogic Express 8.1 SP1
cpe:/a:bea:weblogic_server:7.0.0.1:sp4BEA Systems WebLogic Server 7.0.0.1 SP4
cpe:/a:bea:weblogic_server:7.0.0.1:sp1:expressBEA Systems WebLogic Express 7.0.0.1 SP1
cpe:/a:bea:weblogic_server:6.1:sp2:win32BEA Systems WebLogic Server 6.1 SP2 Win32
cpe:/a:bea:weblogic_server:6.1::express
cpe:/a:bea:weblogic_server:7.0:sp5:win32
cpe:/a:bea:weblogic_server:8.1::express
cpe:/a:bea:weblogic_server:6.1:sp1:expressBEA Systems WebLogic Express 6.1 SP1
cpe:/a:bea:weblogic_server:7.0.0.1:sp3BEA Systems WebLogic Server 7.0.0.1 SP3
cpe:/a:bea:weblogic_server:7.0:sp1:express
cpe:/a:bea:weblogic_server:8.1:sp1BEA Systems WebLogic Server 8.1 SP1
cpe:/a:bea:weblogic_server:6.1:sp2:expressBEA Systems WebLogic Express 6.1 SP2
cpe:/a:bea:weblogic_server:7.0::express
cpe:/a:bea:weblogic_server:7.0.0.1:sp1:win32BEA Systems WebLogic Server 7.0.0.1 SP1 Win32
cpe:/a:bea:weblogic_server:6.1::win32
cpe:/a:bea:weblogic_server:7.0.0.1:sp2:win32BEA Systems WebLogic Server 7.0.0.1 SP2 Win32
cpe:/a:bea:weblogic_server:7.0:sp3:win32
cpe:/a:bea:weblogic_server:7.0:sp3
cpe:/a:bea:weblogic_server:6.1:sp5:win32BEA Systems WebLogic Server 6.1 SP5 Win32
cpe:/a:bea:weblogic_server:7.0:sp5
cpe:/a:bea:weblogic_server:6.1:sp2BEA Systems WebLogic Server 6.1 SP2
cpe:/a:bea:weblogic_server:8.1:sp2:expressBEA Systems WebLogic Express 8.1 SP2
cpe:/a:bea:weblogic_server:6.1:sp6:expressBEA Systems WebLogic Express 6.1 SP6
cpe:/a:bea:weblogic_server:6.1:sp3BEA Systems WebLogic Server 6.1 SP3
cpe:/a:bea:weblogic_server:8.1::win32
cpe:/a:bea:weblogic_server:6.1:sp6:win32BEA Systems WebLogic Server 6.1 SP6 Win32
cpe:/a:bea:weblogic_server:6.1:sp4:expressBEA Systems WebLogic Express 6.1 SP4
cpe:/a:bea:weblogic_server:7.0:sp4
cpe:/a:bea:weblogic_server:7.0:sp2:express
cpe:/a:bea:weblogic_server:7.0:sp3:express
cpe:/a:bea:weblogic_server:7.0.0.1:sp2BEA Systems WebLogic Server 7.0.0.1 SP2
cpe:/a:bea:weblogic_server:8.1:sp2BEA Systems WebLogic Server 8.1 SP2
cpe:/a:bea:weblogic_server:8.1BEA Systems WebLogic Server 8.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2696
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-2696
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200412-1086
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/16421
(UNKNOWN)  XF  weblogic-unexpected-user-identity(16421)
http://www.securityfocus.com/bid/10545
(UNKNOWN)  BID  10545
http://www.osvdb.org/7081
(UNKNOWN)  OSVDB  7081
http://securitytracker.com/id?1010493
(UNKNOWN)  SECTRACK  1010493
http://secunia.com/advisories/11865
(VENDOR_ADVISORY)  SECUNIA  11865
http://dev2dev.bea.com/pub/advisory/59
(UNKNOWN)  BEA  BEA04-62.00

- 漏洞信息

BEA WebLogic Server/WebLogic Express Java RMI不正确会话继承漏洞
中危 授权问题
2004-12-31 00:00:00 2007-10-09 00:00:00
远程  
        
        BEA Systems WebLogic包含多种应用系统集成方案,包括Server/Express/Integration等。
        BEA WebLogic的对Java Remote Method Invocation (RMI)文档描述存在问题,遵从此文档开发的产品可导致权限提升问题。
        问题发生在当客户多次以不同用户登录WebLogic服务器时,文档描述客户的行为是:当RMI请求提交时是没有当前用户关联客户线程的,这对RMI通过T3协议来说是正确的,但针对RMI通过IIOP协议走的情况下是不正确的,任意依赖此文档描述的行为可导致在RMI调用中获得其他用户的验证信息。
        

- 公告与补丁

        厂商补丁:
        BEA Systems
        -----------
        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
        更新的文档可从如下地方获得:
        For WebLogic Server and WebLogic Express 8.1:
        
        http://e-docs.bea.com/wls/docs81/jndi/jndi.html#478033

        For WebLogic Server and WebLogic Express 7.0:
        
        http://e-docs.bea.com/wls/docs70/jndi/jndi.html#477188

        For WebLogic Server and WebLogic Express 6.1:
        
        http://e-docs.bea.com/wls/docs61/jndi/jndi.html#477126

- 漏洞信息

7081
BEA WebLogic RMI Method Identity Theft
Remote / Network Access Authentication Management, Input Manipulation
Loss of Confidentiality, Loss of Integrity

- 漏洞描述

BEA WebLogic Server and BEA WebLogic Express contain a flaw that may allow a malicious user to perform identity theft. The issue is triggered when a client tries to login multiple times into WebLogic Server with different users using the RMI (Remote Method Invocation) over IIOP (Internet Inter-ORB Protocol). It is possible that the flaw may allow certain user actions with a wrong identity resulting in a loss of confidentiality and integrity.

- 时间线

2004-06-14 Unknow
Unknow Unknow

- 解决方案

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the workarounds provided by BEA as listed on the vendor site.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站