Buffer overflow in Bea Weblogic_server
CVE-2008-3257
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a s…
Vulnerability class: Buffer Overflow
EPSS: 0.836 (99.7th percentile) — read the EPSS interpretation.
Affected products
- Bea Weblogic_server — versions 3.1.8, 4.0, 4.0.4
- Bea_systems Apache_connector_in_weblogic_server
- Bea_systems Weblogic_server — versions 10.0_mp1
- Oracle Weblogic_server
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (mailing-list, x_refsource_VIM)
- cve@mitre.org (mailing-list, x_refsource_VIM)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (vdb-entry, x_refsource_XF)
Frequently asked questions
- What is CVE-2008-3257?
- CVE-2008-3257 is a vulnerability in Bea Weblogic_server, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2008-07-22.
- Is CVE-2008-3257 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.