Description
The Sun Admin Console in Sun Application Server 9.0_0.1 does not apply certain configuration changes persistently, which causes the (1) SSL and (2) SSL_MutualAuth ORB listener services to enable all protocols and ciphers after the services are restarted, possibly allowing remote attackers to bypass intended policy.
References
- 45828 vdb-entry
- 25400 vdb-entry
- sun-applicationserver-ssl-weak-security(36169) vdb-entry
- 20070822 Encryption Weakness in Sun Sun AS 9.0_0.1 (build b02-p01) mailing-list