-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0071                  AUSCERT Advisory

                             [Win][UNIX/Linux]
          Updates released for BEA WebLogic, WebLogic and JRockit
                    correcting multiple vulnerabilities
                             4 September 2007
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              WebLogic
                      WebLogic Express
                      JRockit
Operating System:     AIX
                      HP-UX
                      Linux variants
                      Solaris
                      Windows
Impact:               Access Privileged Data
                      Provide Misleading Information
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-2788 CVE-2007-2789 CVE-2007-3698
                      CVE-2007-3922 CVE-2007-4613 CVE-2007-4614
                      CVE-2007-4615 CVE-2007-4616 CVE-2007-4617
                      CVE-2007-4618
Member content until: Tuesday, October 02 2007

Ref:                  AL-2007.0071
                      ESB-2007.0624
                      ESB-2007.0521
                      ESB-2007.0544
                      ESB-2007.0515

Original Bulletin:    http://dev2dev.bea.com/pub/advisory/201
                      http://dev2dev.bea.com/pub/advisory/216
                      http://dev2dev.bea.com/pub/advisory/244
                      http://dev2dev.bea.com/pub/advisory/245
                      http://dev2dev.bea.com/pub/advisory/246
                      http://dev2dev.bea.com/pub/advisory/247
                      http://dev2dev.bea.com/pub/advisory/248 
                      http://dev2dev.bea.com/pub/advisory/249


OVERVIEW:
        
        BEA Systems have released multiple advisories describing 
        vulnerabilities in and updates for BEA WebLogic, WebLogic Express
        and JRockit. 


IMPACT: 

        According to the BEA Systems advisories [1] the following 
        vulnerabilities affect only WebLogic Server and have the following 
        impacts:

         o BEA07-134.00 (CVE-2007-4613): This vulnerability may allow the 
           decryption of SSL streams. To exploit this vulnerability, an 
           attacker would require access to multiple streams which contain 
           the same plain text block and the ability to inject their own 
           ciphertext blocks into the connection.

         o BEA07-149.00 (CVE-2007-4614): This vulnerability may result in
           security policy updates not being correctly applied to managed 
           servers.

        Note that the two advisories mentioned were released in January 
        2007, however, CVE Names have just been allocated and are included 
        in this advisory for completeness.

        The following vulnerabilities affect both WebLogic Server and 
        WebLogic Express:

         o BEA07-175.00 (CVE-2007-4615): This vulnerability may result in 
           clients not being able to correctly determine cipher suites, and 
           fall-back to unencrypted communication.

         o BEA07-176.00 (CVE-2007-4616): This vulnerability may result in
           a server falling back to a null SSL cipher (unencrypted 
           communication) if the client does not offer any supported cipher 
           suites.

         o BEA07-87.02 (CVE-2007-4617): This vulnerability may allow a 
           malicious client to cause a denial of service of server threads.

         o BEA07-148.01 (CVE-2007-4618): This vulnerability may allow 
           malicious clients sending malformed requests to cause a large
           growth in the log file.

        The following vulnerabilities affect JRockit:

         o BEA07-177.00 (CVE-2007-2789, CVE-2007-2788, CVE-2007-3922): This
           advisory describes a new release of JRockit which corrects 
           multiple JRE/JDK vulnerabilities, details of which can be found 
           on the AusCERT web site [2][3][4][5].

         o BEA07-178.00 (CVE-2007-3698): This vulnerability may allow remote 
           attackers to cause a DoS in the Java Secure Socket Extension 
          (JSSE) by sending specially crafted SSL/TLS handshake requests [6].


MITIGATION:

        Patches are available for all of the above mentioned 
        vulnerabilities. Please see the relevant BEA advisory for 
        location of software patches and updates.


REFERENCES:

        [1] Security Advisories and Notifications
            http://dev2dev.bea.com/advisoriesnotifications/

        [2] AL-2007.0071 -- Sun Java Runtime Environment vulnerability 
            allows remote compromise 
            http://www.auscert.org.au/766

        [3] ESB-2007.0624 -- Vulnerability in the Java Runtime Environment 
            Font Parsing Code may Allow an Untrusted Applet to Elevate 
            Privileges
            http://www.auscert.org.au/7982

        [4] ESB-2007.0521 -- Java Runtime Environment Does Not Securely 
            Process XSLT Stylesheets Contained in XML Signatures
            http://www.auscert.org.au/7843

        [5] ESB-2007.0544 -- Vulnerability in Java Runtime Environment May 
            Allow an Untrusted Applet to Circumvent Network Access 
            Restrictions
            http://www.auscert.org.au/7874

        [6] ESB-2007.0515 -- Java Secure Socket Extension Does Not Correctly 
            Process SSL/TLS Handshake Requests Resulting in a Denial of 
            Service (DoS) Condition
            http://www.auscert.org.au/7837

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRtzQsih9+71yA2DNAQL6tQP/U57C/cww1h6X1Al9JIjqijkD1lOkJ+rC
ucH/TQ6xnoXe0zuz7y/p+EfzJUZ0uZrUVoG5P+CrOnhmjZRzDE3GjxJA/PIc46Qj
4hgvjGHO+ei1DnzFBmE7mpHQSOQ+jjEDGsfUg9dK6J+ZiFxMeUWdjyNYB2cndRvz
jtCGPh15Nq4=
=nEUc
-----END PGP SIGNATURE-----