CWE
119
Advisory Published
Updated

CVE-2008-3257: Buffer Overflow

First published: Tue Jul 22 2008(Updated: )

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Oracle WebLogic Server=7.0.0.1-sp4
Oracle WebLogic Server=6.1-sp4
Oracle WebLogic Server=4.5.2-sp1
Oracle WebLogic Server=4.5.1
Oracle WebLogic Server=7.0-sp7
Oracle WebLogic Server=9.2-mp2
Oracle WebLogic Server=8.1
Oracle WebLogic Server=6.1-sp5
Oracle WebLogic Server=4.5.2
Oracle WebLogic Server=9.0
Oracle WebLogic Server=9.2
Oracle WebLogic Server=6.1-sp6
Oracle WebLogic Server=7.0-sp4
Oracle WebLogic Server=9.0-sp3
Oracle WebLogic Server=7.0
Oracle WebLogic Server=9.0-sp1
Oracle WebLogic Server=7.0.0.1-sp1
Oracle WebLogic Server=6.0-sp2
Oracle WebLogic Server=5.1-sp12
Oracle WebLogic Server=5.1-sp11
Oracle WebLogic Server=5.1
Oracle WebLogic Server=6.1-sp3
Oracle WebLogic Server<=10.3
Oracle WebLogic Server=5.1-sp1
Oracle WebLogic Server=6.1-sp8
Oracle WebLogic Server=7.0-sp6
Oracle WebLogic Server=7.0-sp3
Oracle WebLogic Server=8.1-sp5
Oracle WebLogic Server=8.1-sp3
Oracle WebLogic Server=7.0-sp2
Oracle WebLogic Server=9.0-ga
Oracle WebLogic Server=3.1.8
Oracle WebLogic Server=9.0-sp5
Oracle WebLogic Server=4.5.1-sp15
Oracle WebLogic Server=9.0-sp2
Oracle WebLogic Server=5.1-sp6
Oracle WebLogic Server=4.5
Oracle WebLogic Server=7.0-sp5
Oracle WebLogic Server=9.1
Oracle WebLogic Server=6.1-sp1
Oracle WebLogic Server=10.0
Oracle WebLogic Server=6.0
Oracle WebLogic Server=10.0_mp1
Oracle WebLogic Server=9.2-mp1
Oracle WebLogic Server=5.1-sp4
Oracle WebLogic Server=5.1-sp3
Oracle WebLogic Server=6.0-sp6
Oracle WebLogic Server=5.1-sp8
Oracle WebLogic Server=8.1-sp2
Oracle WebLogic Server=5.1-sp13
Oracle WebLogic Server=5.1-sp10
Oracle WebLogic Server=6.1
Oracle WebLogic Server=6.0-sp1
Oracle WebLogic Server=7.0.0.1
Oracle WebLogic Server=5.1-sp5
Oracle WebLogic Server=5.1-sp9
Oracle WebLogic Server=7.0-sp1
Oracle WebLogic Server=7.0.0.1-sp2
Oracle WebLogic Server=8.1-sp6
Oracle WebLogic Server=4.0.4
Oracle WebLogic Server=8.1-sp1
Oracle WebLogic Server=8.1-sp4
Oracle WebLogic Server=6.1-sp2
Oracle WebLogic Server=9.0-sp4
Oracle WebLogic Server=6.1-sp7
Oracle WebLogic Server=4.5.2-sp2
Oracle WebLogic Server=9.1-ga
Oracle WebLogic Server=7.0.0.1-sp3
Oracle WebLogic Server=5.1-sp7
Oracle WebLogic Server
Oracle WebLogic Server=4.0
Oracle WebLogic Server=5.1-sp2

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2008-3257?

    CVE-2008-3257 is classified as critical due to its potential to allow remote code execution.

  • How do I fix CVE-2008-3257?

    To address CVE-2008-3257, upgrade Oracle WebLogic Server to a version that is not vulnerable, specifically versions later than 10.3.

  • Which versions of Oracle WebLogic Server are affected by CVE-2008-3257?

    CVE-2008-3257 affects Oracle WebLogic Server versions 10.3 and earlier.

  • What type of vulnerability is CVE-2008-3257?

    CVE-2008-3257 is a stack-based buffer overflow vulnerability.

  • Can CVE-2008-3257 be exploited remotely?

    Yes, CVE-2008-3257 can be exploited by remote attackers through crafted HTTP requests.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203