发布日期：2003-07-08
更新日期：2003-07-15

受影响系统：

BEA Systems WebLogic Express 8.1
BEA Systems WebLogic Express 7.0.0.1 SP2
BEA Systems WebLogic Express 7.0.0.1 SP1
BEA Systems WebLogic Express 7.0.0.1
BEA Systems WebLogic Express 7.0 SP2
BEA Systems WebLogic Express 7.0 SP1
BEA Systems WebLogic Express 7.0
BEA Systems WebLogic Express 6.1 SP5
BEA Systems WebLogic Express 6.1 SP5
BEA Systems WebLogic Express 6.1 SP4
BEA Systems WebLogic Express 6.1 SP4
BEA Systems WebLogic Express 6.1 SP3
BEA Systems WebLogic Express 6.1 SP3
BEA Systems WebLogic Express 6.1 SP2
BEA Systems WebLogic Express 6.1 SP2
BEA Systems WebLogic Express 6.1 SP1
BEA Systems WebLogic Express 6.1 SP1
BEA Systems Weblogic Server 8.1
BEA Systems Weblogic Server 7.0.0.1 SP2
BEA Systems Weblogic Server 7.0.0.1 SP1
BEA Systems Weblogic Server 7.0.0.1
BEA Systems Weblogic Server 7.0 SP2
BEA Systems Weblogic Server 7.0 SP1
BEA Systems Weblogic Server 7.0
BEA Systems Weblogic Server 6.1 SP5
BEA Systems Weblogic Server 6.1 SP4
BEA Systems Weblogic Server 6.1 SP3
BEA Systems Weblogic Server 6.1 SP2
BEA Systems Weblogic Server 6.1 SP1
BEA Systems WebLogic Express for Win32 7.0.0.1 SP2
BEA Systems WebLogic Express for Win32 7.0.0.1 SP1
BEA Systems WebLogic Express for Win32 7.0.0.1
BEA Systems WebLogic Express for Win32 7.0 SP2
BEA Systems WebLogic Express for Win32 7.0 SP1
BEA Systems WebLogic Express for Win32 7.0
BEA Systems WebLogic Express for Win32 6.1 SP5
BEA Systems WebLogic Express for Win32 6.1 SP4
BEA Systems WebLogic Express for Win32 6.1 SP3
BEA Systems WebLogic Express for Win32 6.1 SP2
BEA Systems WebLogic Express for Win32 6.1 SP1
BEA Systems WebLogic Server for Win32 7.0.0.1 SP2
BEA Systems WebLogic Server for Win32 7.0.0.1 SP1
BEA Systems WebLogic Server for Win32 7.0.0.1
BEA Systems WebLogic Server for Win32 7.0 SP2
BEA Systems WebLogic Server for Win32 7.0 SP1
BEA Systems WebLogic Server for Win32 7.0
BEA Systems WebLogic Server for Win32 6.1 SP5
BEA Systems WebLogic Server for Win32 6.1 SP4
BEA Systems WebLogic Server for Win32 6.1 SP3
BEA Systems WebLogic Server for Win32 6.1 SP2
BEA Systems WebLogic Server for Win32 6.1 SP1
BEA Systems WebLogic Express 6.1
    - HP HP-UX 11i
    - HP HP-UX 11.0
    - IBM AIX 4.3.3
    - Microsoft Windows NT 4.0 SP6a
    - Microsoft Windows NT 4.0 SP6
    - Microsoft Windows NT 4.0 SP5
    - Microsoft Windows NT 4.0 SP4
    - Microsoft Windows NT 4.0 SP3
    - Microsoft Windows NT 4.0 SP2
    - Microsoft Windows NT 4.0 SP1
    - Microsoft Windows NT 4.0
    - Microsoft Windows 2000 Server SP2
    - Microsoft Windows 2000 Server SP1
    - Microsoft Windows 2000 Server
    - Microsoft Windows 2000 Professional SP2
    - Microsoft Windows 2000 Professional SP1
    - Microsoft Windows 2000 Professional
    - Microsoft Windows 2000 Datacenter Server SP2
    - Microsoft Windows 2000 Datacenter Server SP1
    - Microsoft Windows 2000 Datacenter Server
    - Microsoft Windows 2000 Advanced Server SP2
    - Microsoft Windows 2000 Advanced Server SP1
    - Microsoft Windows 2000 Advanced Server
BEA Systems Weblogic Server 6.1
    - HP HP-UX 11i
    - HP HP-UX 11.0
    - IBM AIX 4.3.3
    - Microsoft Windows NT 4.0 SP6a
    - Microsoft Windows NT 4.0 SP6
    - Microsoft Windows NT 4.0 SP5
    - Microsoft Windows NT 4.0 SP4
    - Microsoft Windows 2000 Server SP2
    - Microsoft Windows 2000 Server SP1
    - Microsoft Windows 2000 Server
    - Microsoft Windows 2000 Professional SP2
    - Microsoft Windows 2000 Professional SP1
    - Microsoft Windows 2000 Professional
    - Microsoft Windows 2000 Datacenter Server SP2
    - Microsoft Windows 2000 Datacenter Server SP1
    - Microsoft Windows 2000 Datacenter Server
    - Microsoft Windows 2000 Advanced Server SP2
    - Microsoft Windows 2000 Advanced Server SP1
    - Microsoft Windows 2000 Advanced Server
    - RedHat Linux 6.2
    - RedHat Linux 6.1
    - Sun Solaris 8.0
    - Sun Solaris 7.0
    - Sun Solaris 2.6
BEA Systems WebLogic Express for Win32 6.1
    - Microsoft Windows NT 4.0 SP6a
    - Microsoft Windows NT 4.0 SP6
    - Microsoft Windows NT 4.0 SP5
    - Microsoft Windows NT 4.0 SP4
    - Microsoft Windows NT 4.0 SP3
    - Microsoft Windows NT 4.0 SP2
    - Microsoft Windows NT 4.0 SP1
    - Microsoft Windows NT 4.0
    - Microsoft Windows 2000 Server SP2
    - Microsoft Windows 2000 Server SP1
    - Microsoft Windows 2000 Server
    - Microsoft Windows 2000 Professional SP2
    - Microsoft Windows 2000 Professional SP1
    - Microsoft Windows 2000 Professional
    - Microsoft Windows 2000 Datacenter Server SP2
    - Microsoft Windows 2000 Datacenter Server SP1
    - Microsoft Windows 2000 Datacenter Server
    - Microsoft Windows 2000 Advanced Server SP2
    - Microsoft Windows 2000 Advanced Server SP1
    - Microsoft Windows 2000 Advanced Server
BEA Systems WebLogic Server for Win32 6.1
    - Microsoft Windows NT 4.0 SP6a
    - Microsoft Windows NT 4.0 SP6
    - Microsoft Windows NT 4.0 SP5
    - Microsoft Windows NT 4.0 SP4
    - Microsoft Windows NT 4.0 SP3
    - Microsoft Windows NT 4.0 SP2
    - Microsoft Windows NT 4.0 SP1
    - Microsoft Windows NT 4.0
    - Microsoft Windows 2000 Server SP2
    - Microsoft Windows 2000 Server SP1
    - Microsoft Windows 2000 Server
    - Microsoft Windows 2000 Professional SP2
    - Microsoft Windows 2000 Professional SP1
    - Microsoft Windows 2000 Professional
    - Microsoft Windows 2000 Datacenter Server SP2
    - Microsoft Windows 2000 Datacenter Server SP1
    - Microsoft Windows 2000 Datacenter Server
    - Microsoft Windows 2000 Advanced Server SP2
    - Microsoft Windows 2000 Advanced Server SP1
    - Microsoft Windows 2000 Advanced Server

描述：

---

BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。

WebLogic Server和Express的节点管理器(Node Manager)存在安全问题，远程攻击者可以利用这个漏洞破坏节点管理器，使其不能工作。

当机器上使用节点管理器和用户在WebLogic服务管理员、操作人员访问机器的进程列表旁边时存在漏洞，因为节点管理器的密钥文件密码以明文方式传递给命令行选项，用户可以看到明文密码，利用这个密码可以窃取和修改节点管理器的私钥，可破坏节点管理器，使其不能正常工作。

<*来源：BEA SECURITY ADVISORY
  
  链接：http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-34.jsp
*>

建议：

---

厂商补丁：

BEA Systems
-----------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

WebLogic Server和Express 7.0、7.0.0.1：

采用Service Pack 2并按照下面ZIP文件中包含的指示进行补丁安装：

ftp://ftpna.beasys.com/pub/releases/security/CR093813_70sp2.zip

当Service Pack 3可以下载时，可直接使用SP3来代替Service Pack 2及此补丁。

WebLogic Server和Express 6.1：

采用Service Pack 5并按照下面ZIP文件中包含的指示进行补丁安装：

ftp://ftpna.beasys.com/pub/releases/security/CR093813_61sp5.zip

当Service Pack 6可以下载时，可直接使用SP3来代替Service Pack 5及此补丁。

浏览次数：8401
严重程度：0（网友投票）