{"vuid":"VU#566390","idnumber":"566390","name":"BEA WebLogic Server fails to properly validate certificate chains","keywords":["BEA","WebLogic Server","custom trust manager","certificate chain","BEA04-54.00"],"overview":"There is a vulnerability in BEA WebLogic Server in which certificate chains rejected by the custom trust manager could still be accepted by the server.","clean_desc":"BEA Systems describes WebLogic Server as \"an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed Java applications.\" The WebLogic Server allows for the configuration of custom trust managers. This feature provides the ability to override certain validation errors when evaluating a client's certificate. There is a vulnerability in the way the WebLogic server validates certificate chains that could allow a remote attacker to impersonate a user or remote server. According to the BEA Security Advisory, This vulnerability affects sites using custom trust managers. This vulnerability can occur when WebLogic Server is validating a certificate chain. It occurs under the following circumstances: During an inbound 2-way SSL request (when the user's certificate is validated). During an outbound SSL request (when the remote server's certificate chain is validated). If a certificate chain is validated and accepted but the custom trust manager rejects the chain, the certificate chain may still be accepted. This circumstance allows an attacker using two-way SSL to impersonate a user. When outbound SSL is being used, an attacker can impersonate a remote server. The BEA Security Advisory states that the following versions of WebLogic Server and Express are affected by this vulnerability: WebLogic Server and WebLogic Express 8.1 released through Service Pack 2, on all platforms\nWebLogic Server and WebLogic Express 7.0 released through Service Pack 4, on all platforms","impact":"A remote attacker could impersonate a user or remote server.","resolution":"Upgrade WebLogic Server and WebLogic Express version 8.1\n1. Upgrade to WebLogic Server and WebLogic Express version 8.1 Service Pack 2. 2. Install the patch from: ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar WebLogic Server version 8.1 Service Pack 3 is also supported with this patch. WebLogic Server and WebLogic Express version 7.0 1. Upgrade to WebLogic Server and WebLogic Express version 7.0 Service Pack 5.","workarounds":"","sysaffected":"","thanks":"This vulnerability was reported by BEA Systems Inc.","author":"This document was written by Damon Morda.","public":["http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp","http://secunia.com/advisories/11358/","http://securitytracker.com/alerts/2004/Apr/1009765.html","http://e-docs.bea.com/wls/docs81/secintro/concepts.html#1097287"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2004-04-16T14:40:14Z","publicdate":"2004-04-14T00:00:00Z","datefirstpublished":"2004-04-22T19:13:27Z","dateupdated":"2004-04-22T19:13:34Z","revision":19,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"7","cam_population":"9","cam_impact":"10","cam_easeofexploitation":"7","cam_attackeraccessrequired":"20","cam_scorecurrent":"5.1975","cam_scorecurrentwidelyknown":"6.37875","cam_scorecurrentwidelyknownexploited":"11.10375","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":5.1975,"vulnote":null}