|
|
| |
| It is possible to trigger a race condition in Bea's WebLogic server that can result in the stack and registers being partially overwritten. This allows a remote attacker to execute arbitrary code on the remote machine. |
| |
Credit:
The information has been provided by Peter Gr?ndl of Defcom labs.
|
| |
Vulnerable systems:
Bea WebLogic version prior to V5.1.0 - Service Pack 7
Immune systems:
Bea WebLogic version 5.1.0 Service Pack 7
WebLogic Server has a specific handler for URL requests that start with "dotdot". By sending a large URL (..[aaaaaaaaaaaaaaaaaa]) and then disconnecting, it is possible to trigger a buffer overflow. The result can be anywhere from crashing the web server, to executing arbitrary code on the server with the privileges of the web server (which usually means LocalSystem).
Solution:
Upgrade to Bea WebLogic 5.1.0, Service Pack 7:
http://commerce.beasys.com/downloads/weblogic_server.jsp
|
|
|
|
|
