It is possible to trigger a race condition in Bea's WebLogic server that can result in the stack and registers being partially overwritten. This allows a remote attacker to execute arbitrary code on the remote machine.
Credit:
The information has been provided by Peter Gr?ndl of Defcom labs.
Vulnerable systems:
Bea WebLogic version prior to V5.1.0 - Service Pack 7
Immune systems:
Bea WebLogic version 5.1.0 Service Pack 7
WebLogic Server has a specific handler for URL requests that start with "dotdot". By sending a large URL (..[aaaaaaaaaaaaaaaaaa]) and then disconnecting, it is possible to trigger a buffer overflow. The result can be anywhere from crashing the web server, to executing arbitrary code on the server with the privileges of the web server (which usually means LocalSystem).
