PT-2009-3594 · Oracle · Oracle Weblogic Server

Published 2009-04-15 · Updated 2017-08-17 · CVE-2009-1012

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle BEA WebLogic Server versions 7.0 Gold through SP7 Oracle BEA WebLogic Server versions 8.1 Gold through SP6 Oracle BEA WebLogic Server version 9.0 Oracle BEA WebLogic Server version 9.1 Oracle BEA WebLogic Server versions 9.2 Gold through MP3 Oracle BEA WebLogic Server versions 10.0 Gold through MP1 Oracle BEA WebLogic Server version 10.3

Description The issue affects the confidentiality, integrity, and availability of the system. It is claimed by a reliable researcher to be an integer overflow in an unspecified plug-in that parses HTTP requests, leading to a heap-based buffer overflow. However, Oracle has not commented on these claims.

Recommendations For Oracle BEA WebLogic Server versions 7.0 Gold through SP7, update to a version outside of this range to resolve the issue. For Oracle BEA WebLogic Server versions 8.1 Gold through SP6, update to a version outside of this range to resolve the issue. For Oracle BEA WebLogic Server version 9.0, update to a version outside of this range to resolve the issue. For Oracle BEA WebLogic Server version 9.1, update to a version outside of this range to resolve the issue. For Oracle BEA WebLogic Server versions 9.2 Gold through MP3, update to a version outside of this range to resolve the issue. For Oracle BEA WebLogic Server versions 10.0 Gold through MP1, update to a version outside of this range to resolve the issue. For Oracle BEA WebLogic Server version 10.3, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the plug-in that parses HTTP requests until a patch is available.

Fix

Related Identifiers

CVE-2009-1012

Affected Products

Oracle Weblogic Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2009-1012 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64935 · Note
• http://securitytracker.com/id?1022059 · Note
• http://securityfocus.com/bid/34461 · Note
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Note
• http://secunia.com/secunia_research/2009-22 · Note
• http://osvdb.org/53765 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Note
• http://oracle.com/technology/deploy/security/wls-security/1012.html · Note