CVE-2009-1012: Buffer Overflow
First published: Wed Apr 15 2009(Updated: )
Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle BEA Product Suite | =9.1 | |
| Oracle BEA Product Suite | =8.1-sp6 | |
| Oracle BEA Product Suite | =10.0-mp1 | |
| Oracle BEA Product Suite | =7.0-sp7 | |
| Oracle BEA Product Suite | =9.0 | |
| Oracle BEA Product Suite | =10.3 | |
| Oracle BEA Product Suite | =9.2-mp3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.us-cert.gov/cas/techalerts/TA09-105A.html
- http://www.securitytracker.com/id?1022059
- http://www.oracle.com/technology/deploy/security/wls-security/1012.html
- http://osvdb.org/53765
- http://secunia.com/secunia_research/2009-22/
- http://www.securityfocus.com/bid/34461
- http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64935
Frequently Asked Questions
What is the severity of CVE-2009-1012?
CVE-2009-1012 is considered to have a significant impact on confidentiality, integrity, and availability due to its unspecified nature.
How do I fix CVE-2009-1012?
To fix CVE-2009-1012, you should apply the latest security patches provided by Oracle for affected versions of the BEA WebLogic Server.
Which versions of Oracle BEA WebLogic Server are affected by CVE-2009-1012?
CVE-2009-1012 affects Oracle BEA WebLogic Server versions 7.0, 8.1 (SP6), 9.0, 9.1, 9.2 (MP3), 10.0 (MP1), and 10.3.
What types of attacks are possible due to CVE-2009-1012?
CVE-2009-1012 can potentially allow remote attackers to compromise system confidentiality, integrity, and availability.
Does CVE-2009-1012 affect both Apache and IIS web servers?
Yes, CVE-2009-1012 affects plug-ins for both Apache and IIS web servers in Oracle BEA WebLogic Server.
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/oracle
- canonical/oracle bea product suite
- version/oracle bea product suite/9.1
- version/oracle bea product suite/8.1-sp6
- version/oracle bea product suite/10.0-mp1
- version/oracle bea product suite/7.0-sp7
- version/oracle bea product suite/9.0
- version/oracle bea product suite/10.3
- version/oracle bea product suite/9.2-mp3