Defcom Labs Advisory def-2000-04 - Bea WebLogic Server for Windows NT prior to V5.1.0 (sp7) has a remotely exploitable buffer overflow in the handling of URL's which start with two dots. Arbitrary code can be executed as LocalSystem. Fix available here.
1c0de5ec329656e24655156e39a44ee2e64f733317110e581319f00cbc00b4ba
======================================================================
Defcom Labs Advisory def-2000-04
Bea WebLogic Server dotdot-overflow
Author: Peter Gründl <peter.grundl@defcom.com>
Release Date: 2000-12-19
======================================================================
------------------------=[Brief Description]=-------------------------
It is possible to trigger a race condition that can result in the
stack and registers being partially overwritten.
------------------------=[Affected Systems]=--------------------------
Bea WebLogic Server for Windows NT prior to V5.1.0 - Service Pack 7
----------------------=[Detailed Description]=------------------------
WebLogic Server has a specific handler for URL requests that start
with "dotdot". By sending a large URL (..aaaaaaaaaaaaaaaaaaxlots more)
and disconnecting, it is possible to trigger a buffer overflow. The
result can be anywhere from crashing the web server, to executing
arbitrary code on the server with the privileges of the web server
(which usually means LocalSystem).
---------------------------=[Workaround]=-----------------------------
Upgrade to Bea Weblogic 5.1.0, Service Pack 7:
http://commerce.beasys.com/downloads/weblogic_server.jsp
-------------------------=[Vendor Response]=--------------------------
This issue was brought to the vendor's attention on the 20th of
November, and notification of a fix was received by Defcom on the 19th
of December.
======================================================================
This release was brought to you by Defcom Labs
labs@defcom.com www.defcom.com
======================================================================