Description
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Oracle Weblogic Apache Connector POST Request Buffer Overflow
exploit/windows/http/bea_weblogic_post_bof
Exploit-DB 2
- Oracle Weblogic Apache Connector - POST Buffer Overflow (Metasploit) EDB-18897 · remote · May 19, 2012 · verified
- Bea Weblogic Apache Connector - Code Execution / Denial of Service EDB-6089 · remote · Jul 17, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC mailing-list
- 20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC mailing-list
- 6089 exploit
- http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html
- https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html
- 31146 third-party-advisory
- 30273 vdb-entry
- http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html
- 1020520 vdb-entry
- oracle-weblogic-apacheconnector-bo(43885) vdb-entry
- VU#716387 third-party-advisory
- ADV-2008-2145 vdb-entry