CVE-2008-3257
22.07.2008, 16:41
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.Enginsight
| Vendor | Product | Version |
|---|---|---|
| bea | weblogic_server | 3.1.8 |
| bea | weblogic_server | 4.0 |
| bea | weblogic_server | 4.0.4 |
| bea | weblogic_server | 4.5 |
| bea | weblogic_server | 4.5.1 |
| bea | weblogic_server | 4.5.1:sp15 |
| bea | weblogic_server | 4.5.2 |
| bea | weblogic_server | 4.5.2:sp1 |
| bea | weblogic_server | 4.5.2:sp2 |
| bea | weblogic_server | 5.1 |
| bea | weblogic_server | 5.1:sp1 |
| bea | weblogic_server | 5.1:sp10 |
| bea | weblogic_server | 5.1:sp11 |
| bea | weblogic_server | 5.1:sp12 |
| bea | weblogic_server | 5.1:sp13 |
| bea | weblogic_server | 5.1:sp2 |
| bea | weblogic_server | 5.1:sp3 |
| bea | weblogic_server | 5.1:sp4 |
| bea | weblogic_server | 5.1:sp5 |
| bea | weblogic_server | 5.1:sp6 |
| bea | weblogic_server | 5.1:sp7 |
| bea | weblogic_server | 5.1:sp8 |
| bea | weblogic_server | 5.1:sp9 |
| bea | weblogic_server | 6.0 |
| bea | weblogic_server | 6.0:sp1 |
| bea | weblogic_server | 6.0:sp2 |
| bea | weblogic_server | 6.0:sp6 |
| bea | weblogic_server | 6.1 |
| bea | weblogic_server | 6.1:sp1 |
| bea | weblogic_server | 6.1:sp2 |
| bea | weblogic_server | 6.1:sp3 |
| bea | weblogic_server | 6.1:sp4 |
| bea | weblogic_server | 6.1:sp5 |
| bea | weblogic_server | 6.1:sp6 |
| bea | weblogic_server | 6.1:sp7 |
| bea | weblogic_server | 6.1:sp8 |
| bea | weblogic_server | 7.0 |
| bea | weblogic_server | 7.0:sp1 |
| bea | weblogic_server | 7.0:sp2 |
| bea | weblogic_server | 7.0:sp3 |
| bea | weblogic_server | 7.0:sp4 |
| bea | weblogic_server | 7.0:sp5 |
| bea | weblogic_server | 7.0:sp6 |
| bea | weblogic_server | 7.0:sp7 |
| bea | weblogic_server | 7.0.0.1 |
| bea | weblogic_server | 7.0.0.1:sp1 |
| bea | weblogic_server | 7.0.0.1:sp2 |
| bea | weblogic_server | 7.0.0.1:sp3 |
| bea | weblogic_server | 7.0.0.1:sp4 |
| bea | weblogic_server | 8.1 |
| bea | weblogic_server | 8.1:sp1 |
| bea | weblogic_server | 8.1:sp2 |
| bea | weblogic_server | 8.1:sp3 |
| bea | weblogic_server | 8.1:sp4 |
| bea | weblogic_server | 8.1:sp5 |
| bea | weblogic_server | 8.1:sp6 |
| bea | weblogic_server | 9.0 |
| bea | weblogic_server | 9.0:ga |
| bea | weblogic_server | 9.0:sp1 |
| bea | weblogic_server | 9.0:sp2 |
| bea | weblogic_server | 9.0:sp3 |
| bea | weblogic_server | 9.0:sp4 |
| bea | weblogic_server | 9.0:sp5 |
| bea | weblogic_server | 9.1 |
| bea | weblogic_server | 9.1:ga |
| bea | weblogic_server | 9.2 |
| bea | weblogic_server | 9.2:mp1 |
| bea | weblogic_server | 9.2:mp2 |
| bea | weblogic_server | 10.0 |
| bea_systems | apache_connector_in_weblogic_server | * |
| bea_systems | weblogic_server | 10.0_mp1:_mp1 |
| oracle | weblogic_server | 𝑥 ≤ 10.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References