BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection.
References
Link | Resource |
---|---|
http://dev2dev.bea.com/pub/advisory/141 | Patch Vendor Advisory |
http://www.osvdb.org/20095 | Patch |
http://dev2dev.bea.com/pub/advisory/141 | Patch Vendor Advisory |
http://www.osvdb.org/20095 | Patch |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 00:04
Type | Values Removed | Values Added |
---|---|---|
References | () http://dev2dev.bea.com/pub/advisory/141 - Patch, Vendor Advisory | |
References | () http://www.osvdb.org/20095 - Patch |
Information
Published : 2005-12-31 05:00
Updated : 2024-11-21 00:04
NVD link : CVE-2005-4705
Mitre link : CVE-2005-4705
CVE.ORG link : CVE-2005-4705
JSON object : View
Products Affected
bea
- weblogic_server
CWE