Signature Detail

HTTP: Oracle BEA WebLogic Server Apache Connector Buffer Overflow

There exists a buffer overflow vulnerability in BEA WebLogic Server Apache Connector. The vulnerability is due to a boundary error in the Apache connector. A remote unauthenticated attacker can exploit this vulnerability by sending crafted requests to the target host. Successful exploitation would be a denial of service condition of Apache HTTP services on the target host. In an attack case, the affected server will terminate and all established connections will also be terminated.

Extended Description

Oracle has released the January 2009 critical patch update. The update addresses 41 vulnerabilities affecting the following software: Oracle Database Oracle Secure Backup Oracle TimesTen In-Memory Database Oracle Application Server Oracle Collaboration Suite Oracle E-Business Suite Release Oracle Enterprise Manager Grid Control PeopleSoft Enterprise HRMS JD Edwards Tools Oracle WebLogic Server (formerly BEA WebLogic Server) Oracle WebLogic Portal (formerly BEA WebLogic Portal)

Affected Products

• BEA Systems WebLogic Portal 10.0
• BEA Systems WebLogic Portal 10.0 MP1
• BEA Systems WebLogic Portal 10.2
• BEA Systems WebLogic Portal 10.3
• BEA Systems WebLogic Portal 8.1.0
• BEA Systems WebLogic Portal 8.1.0 SP1
• BEA Systems WebLogic Portal 8.1.0 SP2
• BEA Systems WebLogic Portal 8.1.0 SP3
• BEA Systems WebLogic Portal 8.1.0 SP4
• BEA Systems WebLogic Portal 8.1.0 SP5
• BEA Systems WebLogic Portal 8.1.0 SP6
• BEA Systems WebLogic Portal 9.2
• BEA Systems WebLogic Portal 9.2 MP3
• BEA Systems Weblogic Server 10.0
• BEA Systems Weblogic Server 10.0 MP1
• BEA Systems Weblogic Server 10.3
• BEA Systems Weblogic Server 7.0.0
• BEA Systems Weblogic Server 7.0.0 .0.1
• BEA Systems Weblogic Server 7.0.0 .0.1 SP 1
• BEA Systems Weblogic Server 7.0.0 .0.1 SP 2
• BEA Systems Weblogic Server 7.0.0 .0.1 SP 3
• BEA Systems Weblogic Server 7.0.0 .0.1 SP 4
• BEA Systems Weblogic Server 7.0.0 SP 1
• BEA Systems Weblogic Server 7.0.0 SP 2
• BEA Systems Weblogic Server 7.0.0 SP 3
• BEA Systems Weblogic Server 7.0.0 SP 4
• BEA Systems Weblogic Server 7.0.0 SP 5
• BEA Systems Weblogic Server 7.0.0 SP 6
• BEA Systems Weblogic Server 7.0.0 SP 7
• BEA Systems Weblogic Server 7.0 SP7
• BEA Systems Weblogic Server 8.1
• BEA Systems Weblogic Server 8.1.0
• BEA Systems Weblogic Server 8.1.0 SP 1
• BEA Systems Weblogic Server 8.1.0 SP 2
• BEA Systems Weblogic Server 8.1.0 SP 3
• BEA Systems Weblogic Server 8.1.0 SP 4
• BEA Systems Weblogic Server 8.1.0 SP 5
• BEA Systems Weblogic Server 8.1.0 SP 6
• BEA Systems Weblogic Server 9.0
• BEA Systems Weblogic Server 9.1
• BEA Systems Weblogic Server 9.2
• BEA Systems Weblogic Server 9.2 Maintenance Pack 3
• Oracle Collaboration Suite Release 1 10.1.2
• Oracle E-Business Suite 11i 11.5.10.2
• Oracle E-Business Suite 12 12.0.6
• Oracle Enterprise Manager Grid Control 10g 10.2.0.4
• Oracle Oracle10g Application Server 10.1.2 .2.0
• Oracle Oracle10g Application Server 10.1.2.3.0
• Oracle Oracle10g Application Server 10.1.3 .3.0
• Oracle Oracle10g Enterprise Edition 10.1.0 .5
• Oracle Oracle10g Enterprise Edition 10.2.0 .2
• Oracle Oracle10g Enterprise Edition 10.2.0.2 64 bit
• Oracle Oracle10g Enterprise Edition 10.2.0 .3
• Oracle Oracle10g Enterprise Edition 10.2.0.4
• Oracle Oracle10g Personal Edition 10.1.0.5
• Oracle Oracle10g Personal Edition 10.2.0 .2
• Oracle Oracle10g Personal Edition 10.2.0 .3
• Oracle Oracle10g Personal Edition 10.2.0.4
• Oracle Oracle10g Standard Edition 10.1.0 .5
• Oracle Oracle10g Standard Edition 10.2.0 .2
• Oracle Oracle10g Standard Edition 10.2.0 .3
• Oracle Oracle10g Standard Edition 10.2.0.4
• Oracle Oracle11g Enterprise Edition 11.1.0 6
• Oracle Oracle11g Standard Edition 11.1.0 6
• Oracle Oracle11g Standard Edition One 11.1.0 6
• Oracle Oracle9i Enterprise Edition 9.2.0.8.0
• Oracle Oracle9i Enterprise Edition 9.2.0 .8DV
• Oracle Oracle9i Personal Edition 9.2.0 .8
• Oracle Oracle9i Personal Edition 9.2.0 .8DV
• Oracle Oracle9i Standard Edition 9.2.0.8
• Oracle Oracle9i Standard Edition 9.2.0 .8DV
• Oracle Secure Backup 10.1.0.1
• Oracle Secure Backup 10.1.0.2
• Oracle Secure Backup 10.1.0.3
• Oracle Secure Backup 10.2.0.2
• Oracle Secure Backup 10.2.0.3
• Oracle TimesTen In-Memory Database 7.0.5.1.0
• Oracle TimesTen In-Memory Database 7.0.5.2.0
• Oracle TimesTen In-Memory Database 7.0.5.3.0
• Oracle TimesTen In-Memory Database 7.0.5.4.0

References

• BugTraq: 33177
• CVE: CVE-2008-5457