• info
• discussion
• exploit
• solution
• references

BEA WebLogic Server and WebLogic Express Certificate Chain User Impersonation Vulnerability

Solution:
BEA has released an advisory BEA04-54.00 to address this issue. Please see the referenced advisory for more information.


BEA Systems WebLogic Express for Win32 8.1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems Weblogic Server 8.1 SP 1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Express for Win32 8.1 SP 1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems Weblogic Server 8.1 SP 2

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Server for Win32 8.1 SP 2

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Express 8.1 SP 2

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Server for Win32 8.1 SP 1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Server for Win32 8.1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems Weblogic Server 8.1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Express 8.1 SP 1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Express for Win32 8.1 SP 2

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar

BEA Systems WebLogic Express 8.1

• BEA Systems CR129371_81sp2.jar
  ftp://ftpna.beasys.com/pub/releases/security/CR129371_81sp2.jar