Oracle Sounds Alert Over Unpatched WebLogic Server Flaw

Oracle officials are issuing a red alert regarding a flaw affecting the Apache plug-in for Oracle WebLogic after exploit codes for the vulnerability were posted in public forums.

The flaw affects a number of versions of Oracle WebLogic Server--formerly BEA WebLogic Server--and can be exploited remotely by a hacker without authentication to execute code or cause the server to crash. With a CVSS score of 10.0, the situation was considered serious enough for Oracle to release its first emergency alert since it began its Critical Patch Update process in 2005.

“Unfortunately, the person(s) who published this vulnerability and associated exploit codes did not contact Oracle before publicly disclosing this issue,” Eric Maurice, software security assurance director at Oracle, wrote in a blog posting July 28. “This means that the vulnerability was made public before providing Oracle an opportunity to develop an appropriate fix for this issue and notify its customers.”

The flaw is a stack-based buffer overflow vulnerability in the Apace Connector in WebLogic Server that hackers can exploit via a long HTTP version string. The vulnerable versions of the product include version 10.0 released through Maintenance Pack 1 on all platforms, WebLogic Server 9.2 released through MP3 on all platforms and numerous other versions that can be found here.

Some information on workarounds has been published while users await a patch. Users can configure Apache to reject certain invalid requests by adding LimitRequestLine 4000 as a parameter to the httpd.conf file and restarting Apache.

“If there are cases where the use of the LimitRequestLine parameter is not an option, users may also consider use of mod_security in Apache Web Server environments,” according to an advisory from Oracle. “This is available in open source from http://www.modsecurity.org/ to address the vulnerability. The mod_security module need only be installed and enabled in order to provide a workaround for this vulnerability.”

According to Maurice, a patch will be made out-of-cycle and will be coming soon.