Oracle WebLogic Server Apache Connector Transfer-Encoding buffer overflow

2008-10-31T00:00:00
ID SAINT:7EAFE6F06DA5302D7D061FB333FFAC02
Type saint
Reporter SAINT Corporation
Modified 2008-10-31T00:00:00

Description

Added: 10/31/2008
CVE: CVE-2008-4008
BID: 31683
OSVDB: 49283

Background

Oracle WebLogic Server (formerly BEA WebLogic Server) is a Java web application platform.

Problem

A buffer overflow vulnerability allows remote attackers to execute arbitrary commands by sending a specially crafted Transfer-Encoding header in an HTTP request.

Resolution

Install the latest WebLogic Server plug-in referenced in the Oracle Security Advisory.

References

<https://support.bea.com/application_content/product_portlets/securityadvisories/2806.html>

Limitations

Exploit works on the WebLogic Server Connector for Apache 1.0.1136334.

Platforms

Windows