CVE-2004-2424

Vulnerability

BEA WebLogic Server and WebLogic Express versions 8.1 through 8.1 SP2 contain a flaw where HTTPS sessions do not properly release network ports after the session ends. The exact actions that trigger this behavior are unknown, but the result is that the server holds ports open indefinitely, leading to resource exhaustion [1].

Exploitation

A remote attacker can send crafted HTTPS requests to the server, causing it to retain network ports even after the session terminates. No authentication is required; the attacker only needs network access to the server's HTTPS port. The specific sequence of actions is not publicly documented, but the vulnerability can be triggered by unknown actions within HTTPS sessions [1].

Impact

Successful exploitation leads to a denial of service (DoS) condition as all available network ports are consumed, preventing legitimate clients from establishing new connections. The server becomes unresponsive until ports are freed or the system is restarted [1].

Mitigation

BEA Systems released a fix for this issue; users should upgrade to a version beyond 8.1 SP2. The Secunia advisory (now Flexera) provides details on the patch availability [1]. No workaround is documented, and the vulnerability is not listed on the CISA KEV.