CVE-2008-4008

Related Files

BEA Weblogic Transfer-Encoding Buffer Overflow

Posted Nov 26, 2009

Authored by Pusscat | Site metasploit.com

This Metasploit module exploits a stack based buffer overflow in the BEA Weblogic Apache plugin. This vulnerability exists in the error reporting for unknown Transfer-Encoding headers. You may have to run this twice due to timing issues with handlers.

tags | exploit, overflow

advisories | CVE-2008-4008

SHA-256 | ba8f35f7d7e08834aa8e9aaa62c2d259a6ba632f79794a0647b915f1830dfd5c

Download | Favorite | View

iDEFENSE Security Advisory 2008-10-29.2

Posted Oct 31, 2008

Authored by iDefense Labs, Sean Larsson, Joshua J. Drake | Site idefense.com

iDefense Security Advisory 10.29.08 - Remote exploitation of a stack based buffer overflow vulnerability in Oracle Corp.'s WebLogic Server Apache Connector could allow an attacker to execute arbitrary code with the privileges of the affected service. A stack based buffer overflow vulnerability exists in the Apache Connector of Oracle (formerly BEA) WebLogic Server. When parsing a request with an invalid parameter the module uses a string without properly validating its length. This string is copied into a fixed sized stack buffer. This results in a stack based buffer overflow. iDefense has confirmed the existence of this vulnerability in WebLogic Server Apache Connector version 10.0. Previous versions may also be affected.

tags | advisory, remote, overflow, arbitrary

advisories | CVE-2008-4008

SHA-256 | 92646871e75b29ac768127a34b35cd0ed021ef5d8cb5332e1bcb8be06a4c49f1

Download | Favorite | View