[ news_security_news ]
Oracle WebLogic Hit With Zero-Day Exploit
David Utter
Staff Writer
2008-07-31
 Insider Reports RSS Feed
A workaround emerged from Oracle as news circulated of a remotely exploitable flaw, without requiring authentication, involving the WebLogic platform.
Both the WebLogic Server and WebLogic Express products, acquired by Oracle when the company purchased BEA, suffer from the newly disclosed vulnerability.
SANS Internet Storm Center said the problem stems from the Apache Connector used by the products. A WebLogic advisory noted the flaw could be exploited without authentication.
Sites using Apache servers that are already configured with the mod_security module are protected from this vulnerability by the default core ruleset, according to the advisory. Using mod_security with the WebLogic plug-in for Apache serves as one workaround suggested by Oracle.
The other workaround calls for an edit to httpd.conf and a restart:
It is possible to configure Apache and avert this vulnerability by rejecting certain invalid requests. To do so, add the following parameter to the httpd.conf file and restart Apache:
LimitRequestLine 4000
See: Apache LimitRequestLine documentation for more information
Note: This parameter limits the maximum URL length to less than 4000 bytes.
The problem sounds like a buffer overflow, which IBM Xforce said is stack-based in nature. ZDNet noted Oracle has disclosed 112 vulnerabilities in its products in 2008.
The zero-day nature of the flaw's disclosure, and the lack of a need for authentication, makes it likely an active exploit will emerge. Web application servers like WebLogic regularly provide functionality to sites where financial details pass between visitors and the business site.
As such information holds great appeal for criminals, applying a workaround quickly should be a priority for security pros.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
