[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2008-3257

Date: (C)2008-07-22   (M)2017-10-04
 
CVSS Score: 10.0Access Vector: NETWORK
Exploitability Subscore: 10.0Access Complexity: LOW
Impact Subscore: 10.0Authentication: NONE
 Confidentiality: COMPLETE
 Integrity: COMPLETE
 Availability: COMPLETE











Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

Reference:
SECTRACK-1020520
http://www.attrition.org/pipermail/vim/2008-July/002036.html
BID-30273
SECUNIA-31146
EXPLOIT-DB-6089
ADV-2008-2145
VU#716387
http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html
http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html
oracle-weblogic-apacheconnector-bo(43885)

CPE    54
cpe:/a:bea:weblogic_server:10.0
cpe:/a:bea:weblogic_server:9.2
cpe:/a:bea:weblogic_server:9.1
cpe:/a:bea:weblogic_server:4.5.2:sp2
...
CWE    1
CWE-119

© 2013 SecPod Technologies