Vulnerability CVE-2005-1748 - CERT Civis.Net

Vulnerability Name:

CVE-2005-1748 (CCN-22041)

Assigned:

2005-05-24

Published:

2005-05-24

Updated:

2018-10-30

Summary:

The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2005-1748

Source: BEA
Type: Vendor Advisory
BEA05-81.00

Source: CCN
Type: BEA Systems Inc. Web site
BEA Product Documentation

Source: CCN
Type: SA15486
BEA WebLogic Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
15486

Source: CCN
Type: SECTRACK ID: 1014049
BEA WebLogic Server and WebLogic Portal Have Multiple Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1014049

Source: CCN
Type: OSVDB ID: 16839
BEA WebLogic LDAP Server Anonymous Bind

Source: BID
Type: UNKNOWN
13717

Source: CCN
Type: BID-13717
BEA WebLogic Server and WebLogic Express Multiple Remote Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2005-0608

Source: XF
Type: UNKNOWN
weblogic-ldap-obtain-information(22041)

Source: CCN
Type: BEA Systems Security Advisory: (BEA05-81.00)
Anonymous binds to the embedded LDAP server are allowed

Source: CCN
Type: BEA Systems Inc. Security Advisory: (BEA06-81.01)
Anonymous binds to the embedded LDAP server are allowed.

Source: CCN
Type: BEA Systems, Inc. Security Advisory: (BEA06-81.02)
Anonymous binds to the embedded LDAP server are allowed.

Vulnerable Configuration:

Configuration 1:

cpe:/a:bea:weblogic_server:6.0:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*

OR cpe:/a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*

Denotes that component is vulnerable