 | ||||
| << Previous | INDEX | Search | src / Print | Next >> |
| ||||
| |||||||||||||||
Date: Wed, 15 Apr 2009 11:57:34 +0200 To: bugtraq@securityfocus.com Subject: Secunia Research: Oracle BEA WebLogic Server Plug-ins Certificate Buffer Overflow From: Secunia Research <remove-vuln@secunia.com.> X-Virus-Scanned: antivirus-gw at tyumen.ru
Secunia Research 15/04/2009 - Oracle BEA WebLogic Server Plug-ins Certificate Buffer Overflow -
Table of Contents Affected Software....................................................1 Severity.............................................................2 Vendor's Description of Software.....................................3 Description of Vulnerability.........................................4 Solution.............................................................5 Time Table...........................................................6 Credits..............................................................7 References...........................................................8 About Secunia........................................................9 Verification........................................................10
1) Affected Software * Oracle BEA WebLogic Server Plug-ins version 1.0.1166189. NOTE: Other versions may also be affected.
2) Severity Rating: Highly critical Impact: System access Where: From Remote
3) Vendor's Description of Software "... the world's best application server for building and deploying enterprise applications and services ...". Product Link: http://www.oracle.com/technology/products/weblogic/index.html
4) Description of Vulnerability Secunia Research has discovered a vulnerability in the Oracle BEA WebLogic Server plug-ins for web servers, which can be exploited by malicious people to compromise a vulnerable system. The Oracle BEA WebLogic Server can be configured to receive requests via an Apache web server. In this case, a plug-in is installed in the Internet-facing web server that passes the request to a WebLogic server. The Apache web server may be configured to accept SSL connections and forward the request to the WebLogic server along with any SSL-related information. If the SSL client supplies a certificate (and the Apache server is configured to accept it), then the certificate is passed to the WebLogic plug-in via an environment variable. The vulnerability is caused by a boundary error when parsing certificates and can be exploited to cause a stack-based buffer overflow by supplying a specially crafted certificate. Successful exploitation may allow execution of arbitrary code.
5) Solution Apply patches released by the vendor.
6) Time Table 01/03/2009 - Vendor notified. 06/03/2009 - Vendor confirms vulnerability. 17/03/2009 - Vendor provides preliminary patch. 15/04/2009 - Public disclosure.
7) Credits Discovered by Dyon Balding, Secunia Research.
8) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2009-0190 for the vulnerability.
9) About Secunia Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration: http://secunia.com/advisories/business_solutions/ Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security. http://secunia.com/advisories/ Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general: http://secunia.com/secunia_research/ Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions: http://secunia.com/corporate/jobs/ Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/advisories/mailing_lists/
10) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2009-23/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/
| |||||||||||||||
|
|
|
