Oracle mod_wl HTTP Request Method Remote Buffer Overflow

Publish date: July 21, 2015
  Severity: CRITICAL
  CVE Identifier: CVE-2008-3257
  Advisory Date: JUL 21, 2015

  DESCRIPTION

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request. NOTE: it is possible that this overlaps CVE-2008-2579 or another issue disclosed in Oracle's CPUJul2008 advisory.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1002645
  Trend Micro Deep Security DPI Rule Name: 1002645 - Oracle mod_wl HTTP Request Method Remote Buffer Overflow

  AFFECTED SOFTWARE AND VERSION

  • BEA Systems WebLogic Server 10.0
  • BEA Systems WebLogic Server 10.0 MP1
  • BEA Systems WebLogic Server 3.1.8
  • BEA Systems WebLogic Server 4.0
  • BEA Systems WebLogic Server 4.0.4
  • BEA Systems WebLogic Server 4.5
  • BEA Systems WebLogic Server 4.5.1
  • BEA Systems WebLogic Server 4.5.1 SP15
  • BEA Systems WebLogic Server 4.5.2
  • BEA Systems WebLogic Server 4.5.2 SP1
  • BEA Systems WebLogic Server 4.5.2 SP2
  • BEA Systems WebLogic Server 5.1
  • BEA Systems WebLogic Server 5.1 SP1
  • BEA Systems WebLogic Server 5.1 SP10
  • BEA Systems WebLogic Server 5.1 SP11
  • BEA Systems WebLogic Server 5.1 SP12
  • BEA Systems WebLogic Server 5.1 SP13
  • BEA Systems WebLogic Server 5.1 SP2
  • BEA Systems WebLogic Server 5.1 SP3
  • BEA Systems WebLogic Server 5.1 SP4
  • BEA Systems WebLogic Server 5.1 SP5
  • BEA Systems WebLogic Server 5.1 SP6
  • BEA Systems WebLogic Server 5.1 SP7
  • BEA Systems WebLogic Server 5.1 SP8
  • BEA Systems WebLogic Server 5.1 SP9
  • BEA Systems WebLogic Server 6.0
  • BEA Systems WebLogic Server 6.0 SP1
  • BEA Systems WebLogic Server 6.0 SP2
  • BEA Systems WebLogic Server 6.0 SP6
  • BEA Systems WebLogic Server 6.1
  • BEA Systems WebLogic Server 6.1 SP1
  • BEA Systems WebLogic Server 6.1 SP2
  • BEA Systems WebLogic Server 6.1 SP3
  • BEA Systems WebLogic Server 6.1 SP4
  • BEA Systems WebLogic Server 6.1 SP5
  • BEA Systems WebLogic Server 6.1 SP6
  • BEA Systems WebLogic Server 6.1 SP7
  • BEA Systems WebLogic Server 6.1 SP8
  • BEA Systems WebLogic Server 7.0
  • BEA Systems WebLogic Server 7.0 SP1
  • BEA Systems WebLogic Server 7.0 SP2
  • BEA Systems WebLogic Server 7.0 SP3
  • BEA Systems WebLogic Server 7.0 SP4
  • BEA Systems WebLogic Server 7.0 SP5
  • BEA Systems WebLogic Server 7.0 SP6
  • BEA Systems WebLogic Server 7.0 SP7
  • BEA Systems WebLogic Server 7.0.0.1
  • BEA Systems WebLogic Server 7.0.0.1 SP1
  • BEA Systems WebLogic Server 7.0.0.1 SP2
  • BEA Systems WebLogic Server 7.0.0.1 SP3
  • BEA Systems WebLogic Server 7.0.0.1 SP4
  • BEA Systems WebLogic Server 8.1
  • BEA Systems WebLogic Server 8.1 SP1
  • BEA Systems WebLogic Server 8.1 SP2
  • BEA Systems WebLogic Server 8.1 SP3
  • BEA Systems WebLogic Server 8.1 SP4
  • BEA Systems WebLogic Server 8.1 SP5
  • BEA Systems WebLogic Server 8.1 SP6
  • BEA Systems WebLogic Server 9.0
  • BEA Systems WebLogic Server 9.0 GA
  • BEA Systems WebLogic Server 9.0 SP1
  • BEA Systems WebLogic Server 9.0 SP2
  • BEA Systems WebLogic Server 9.0 SP3
  • BEA Systems WebLogic Server 9.0 SP4
  • BEA Systems WebLogic Server 9.0 SP5
  • BEA Systems WebLogic Server 9.1
  • BEA Systems WebLogic Server 9.1 GA
  • BEA Systems WebLogic Server 9.2
  • BEA Systems WebLogic Server 9.2 MP1
  • BEA Systems WebLogic Server 9.2 MP2
  • BEA Systems apache_connector_in_weblogic_server
  • Oracle weblogic_server 10.3

Featured Stories