Info

Disclosure

Jan 24, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

BEA WebLogic contains a flaw that may lead to an administrator believing that a new security provider has been activated even though it is not active yet. This is because WebLogic does not activate a security provider before the system is rebooted. This may lead to a loss of integrity.

Classification

Location: Local Access Required
Attack Type: Other
Impact: Impact Unknown
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, the vendor has released a patch to address this vulnerability.

Products

BEA Systems, Inc.

WebLogic Server

9.0

References

Security Tracker: 1015528
Bugtraq ID: 16358
Secunia Advisory ID: 18592
CVE ID: 2006-0429 (see also: NVD)
ISS X-Force ID: 24298
VUPEN Advisory: ADV-2006-0313
Keyword: BEA06-116.00
Vendor Specific Advisory URL: http://dev2dev.bea.com/pub/advisory/173

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/22773