CVE-2007-0432

Description

BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote attackers to bypass authorization policies and route requests to back-end services or conduct other unauthorized activities.

Affected products

• bea / aqualogic_service_bus2.0 – 2.0
• bea / aqualogic_service_bus2.1 – 2.1
• bea / aqualogic_service_bus2.5 – 2.5

References

• MISChttp://www.securityfocus.com/bid/22082
• VENDOR_ADVISORYhttp://secunia.com/advisories/23786
• MISChttp://osvdb.org/32862
• MISChttp://securitytracker.com/id?1017523
• MISChttp://dev2dev.bea.com/pub/advisory/224