From: BEA Systems Inc.
Minor Subject: Upgrade and patches are available to prevent a showcode vulnerability
Product(s) Affected: WebLogic Server and WebLogic Express
Threat level: Low
To be exploited, this security vulnerability it requires cross-mounting of disks that support case-insensitive filenames to an operating system that has case-sensitive filenames.
Severity: Low
Some URLs will not be correctly protected.
Recently a problem was identified that could potentially cause a security vulnerability in certain versions of WebLogic Server and WebLogic Express. Patches are available to correct this problem (see Section II below). BEA Systems treats such possibilities with the highest degree of urgency and does everything possible to ensure the security of all customer assets. As a result, we strongly suggest the following action:
I. Read the following advisory.This vulnerability occurs in both WebLogic Server and WebLogic Express. Throughout the rest of this advisory, references to WebLogic Server apply to both products.
II. Apply the suggested action.
III. If you know of any additional users interested in future security advisories, please forward them the registration instructions below.
I. ADVISORY
This vulnerability can occur when WebLogic Server is running on an operating system that provides case-sensitive filenames and cross-mounts directories containing Web applications from an operating system that does not support case-sensitive filenames. For example, this problem could occur when mounting Windows-based Web applications onto a Linux-based WebLogic Server.
This vulnerability can result in some URL patterns in the web.xml file not being correctly evaluated and therefore not correctly protected. Therefore, some URLs may not be correctly protected. The associated patch adds configuration options to specify that Web application files should be treated as case-insensitive even though the current operating system is running in a case-sensitive mode.
The patches below address this vulnerability.
The following versions of WebLogic Server are affected by this vulnerability:
- For WebLogic Server 8.1, released through Service Pack 2, on non-Windows
- platforms
- For WebLogic Server 7.0, released through Service Pack 5, on non-Windows platforms
- For WebLogic Server 6.1, released through Service Pack 6, on non-Windows platforms
II. SUGGESTED ACTION
BEA strongly recommends the following course of actions:
Ensure that there is no "case confusion" on the mounted file system. That is, ensure that the expected case is appearing for all filenames and that this case matches what is specified in the URL patterns of the web.xml files.
Apply the patches described below:
- For WebLogic Server 8.1, upgrade to WebLogic Server 8.1 Service Pack 3.
- For WebLogic Server and WebLogic Express 7.0 perform the following steps:
-
- Upgrade to WebLogic Server 7.0 Service Pack 5
- Download and apply the patch: ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/CR128940_700sp5.jar
WebLogic Server 7.0 Service Pack 6 will include the functionality in this patch.
- For WebLogic Server and WebLogic Express 6.1 perform the following steps:
-
- Upgrade to WebLogic Server 6.1 Service Pack 6
- Download and apply the patch:
- ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/CR128940_610sp6.jar
WebLogic Server 6.1 Service Pack 7 will include the functionality in this patch.
BEA Systems strongly suggests that customers apply the remedies recommended in all our security advisories. BEA Systems also urges customers to apply every Service Pack as they are released. Service Packs include a roll-up of all bug fixes for each version of the product, as well as each of the prior Service Packs. Service Packs and information about them can be found at:
http://commerce.beasys.com/downloads/weblogic_server.jsp#wls
Note: Information about securing BEA WebLogic Server and Express can be found in Securing a Production Environment at http://e-docs.bea.com/wls/docs81/lockdown/index.html.
BEA Systems strongly encourage you to review this documentation so that you can be assured that your server deployment is securely configured.
III. FUTURE SECURITY COMMUNICATIONS
As a policy, if there are any security-related issues with any BEA product, BEA Systems will distribute an advisory and instructions with the appropriate course of action. Because the security of your site, data, and code is our highest priority, we are committed to communicating all security-related issues clearly and openly.
All previous advisories can be viewed at http://dev2dev.bea.com/advisoriesnotifications/.
BEA Systems has established an opt-in emailing list specifically targeted for product security advisories. As a policy, if a user has opted-in to our emailing list and there are any security issues with the BEA product(s) he/she is using, BEA Systems will distribute an advisory and instructions via email with the appropriate course of action.
ADDITIONAL USERS WHO WISH TO REGISTER FOR ADVISORY DISTRIBUTION SHOULD FOLLOW THE REGISTRATION DIRECTIONS AT http://dev2dev.bea.com/advisoriesnotifications/.
IV. REPORTING SECURITY ISSUES
Security issues can be reported to BEA Systems by sending email to secalert@bea.com or by following the directions at http://dev2dev.bea.com/advisoriesnotifications/. All reports of security issues will be promptly reviewed and all necessary actions taken to ensure the continued security of all customer assets.
If you have any questions or care to verify the authenticity of this advisory, please contact BEA Technical Support at support@bea.com.
