Published: 22/07/2008 Updated: 29/09/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and previous versions allows remote malicious users to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
bea weblogic server 3.1.8
bea weblogic server 4.5.1
bea weblogic server 4.5.2
bea weblogic server 5.1
bea weblogic server 6.1
bea weblogic server 7.0.0.1
bea weblogic server 7.0
bea weblogic server 8.1
bea weblogic server 9.0
bea weblogic server 9.1
bea weblogic server 10.0
bea weblogic server 6.0
bea weblogic server 9.2
bea weblogic server 4.0
bea weblogic server 4.0.4
bea systems apache connector in weblogic server
bea weblogic server 4.5
bea systems weblogic server 10.0_mp1
oracle weblogic server

#// Bea Weblogic -- Apache Connector Remote Exploit +-1day #// Should stack break latest Windows Server 2003 <address space randomization> #// BIG THANKS TO #// "dong-hun you"(Xpl017Elz) in INetCop - for his paper #// "Title: Advanced exploitation in exec-shield (Fedora Core case study)" #// His technique works fine against Windows 2003 late ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking HttpFingerprint = { :pat ...

FortiSIEM Incapsula WAF Parser Custom Why did we create a custom Incapsula WAF for FortiSIEM? Because the latest version of FortiSIEM doesn't support this parser or API yet Furthermore, Common Event Format(CEF) logs that have come to the FortiSIEM will be parsed to the generic CEF instead The structure of the parser <patternDefinitions> <!-- Defi

CWE-119 http://www.attrition.org/pipermail/vim/2008-July/002035.html http://www.attrition.org/pipermail/vim/2008-July/002036.html http://www.securitytracker.com/id?1020520 http://secunia.com/advisories/31146 http://www.kb.cert.org/vuls/id/716387 http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html http://www.securityfocus.com/bid/30273 http://www.vupen.com/english/advisories/2008/2145/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43885 https://www.exploit-db.com/exploits/6089 https://nvd.nist.gov https://github.com/SunatP/FortiSIEM-Incapsula-Parser https://www.exploit-db.com/exploits/6089/https://www.kb.cert.org/vuls/id/716387

CVE-2008-3257

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect