CVE-2008-3257: Buffer Overflow
Published Jul 22, 2008
·Updated
Stack-based buffer overflow in the Apache Connector (modwl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
Affected Software
72 affected components
Bea WebLogic Server=7.0.0.1-sp4
Bea WebLogic Server=6.1-sp4
Bea WebLogic Server=4.5.2-sp1
Bea WebLogic Server=4.5.1
Bea WebLogic Server=7.0-sp7
Bea WebLogic Server=9.2-mp2
Bea WebLogic Server=8.1
Bea WebLogic Server=6.1-sp5
Bea WebLogic Server=4.5.2
Bea WebLogic Server=9.0
Bea WebLogic Server=9.2
Bea WebLogic Server=6.1-sp6
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=9.0-sp3
Bea WebLogic Server=7.0
Bea WebLogic Server=9.0-sp1
Bea WebLogic Server=7.0.0.1-sp1
Bea WebLogic Server=6.0-sp2
Bea WebLogic Server=5.1-sp12
Bea WebLogic Server=5.1-sp11
Bea WebLogic Server=5.1
Bea WebLogic Server=6.1-sp3
Oracle WebLogic Server<=10.3
Bea WebLogic Server=5.1-sp1
Bea WebLogic Server=6.1-sp8
Bea WebLogic Server=7.0-sp6
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=8.1-sp5
Bea WebLogic Server=8.1-sp3
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=9.0-ga
Bea WebLogic Server=3.1.8
Bea WebLogic Server=9.0-sp5
Bea WebLogic Server=4.5.1-sp15
Bea WebLogic Server=9.0-sp2
Bea WebLogic Server=5.1-sp6
Bea WebLogic Server=4.5
Bea WebLogic Server=7.0-sp5
Bea WebLogic Server=9.1
Bea WebLogic Server=6.1-sp1
Bea WebLogic Server=10.0
Bea WebLogic Server=6.0
Bea Systems Weblogic Server=10.0_mp1
Bea WebLogic Server=9.2-mp1
Bea WebLogic Server=5.1-sp4
Bea WebLogic Server=5.1-sp3
Bea WebLogic Server=6.0-sp6
Bea WebLogic Server=5.1-sp8
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=5.1-sp13
Bea WebLogic Server=5.1-sp10
Bea WebLogic Server=6.1
Bea WebLogic Server=6.0-sp1
Bea WebLogic Server=7.0.0.1
Bea WebLogic Server=5.1-sp5
Bea WebLogic Server=5.1-sp9
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0.0.1-sp2
Bea WebLogic Server=8.1-sp6
Bea WebLogic Server=4.0.4
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp4
Bea WebLogic Server=6.1-sp2
Bea WebLogic Server=9.0-sp4
Bea WebLogic Server=6.1-sp7
Bea WebLogic Server=4.5.2-sp2
Bea WebLogic Server=9.1-ga
Bea WebLogic Server=7.0.0.1-sp3
Bea WebLogic Server=5.1-sp7
Bea Systems Apache Connector In Weblogic Server
Bea WebLogic Server=4.0
Bea WebLogic Server=5.1-sp2
Event History
Jul 22, 2008
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3257?
CVE-2008-3257 is classified as critical due to its potential to allow remote code execution.
2
How do I fix CVE-2008-3257?
To address CVE-2008-3257, upgrade Oracle WebLogic Server to a version that is not vulnerable, specifically versions later than 10.3.
3
Which versions of Oracle WebLogic Server are affected by CVE-2008-3257?
CVE-2008-3257 affects Oracle WebLogic Server versions 10.3 and earlier.
4
What type of vulnerability is CVE-2008-3257?
CVE-2008-3257 is a stack-based buffer overflow vulnerability.
5
Can CVE-2008-3257 be exploited remotely?
Yes, CVE-2008-3257 can be exploited by remote attackers through crafted HTTP requests.