Sploitus

Exploit for Oracle WebLogic Server Apache Connector POST buffer overflow

CVE-2008-3257

saint · 2008-07-25

Exploit Code

MARKDOWN32 lines
## https://sploitus.com/exploit?id=SAINT:B9FC881966A71AF98F59E5D20BA2A052
Added: 07/25/2008  
CVE: CVE-2008-3257  
BID: 30273  
OSVDB: 47096  


### Background

Oracle WebLogic Server (formerly BEA WebLogic Server) is a Java web application platform. 

### Problem

A buffer overflow in the Apache Connector for WebLogic Server allows remote attackers to execute arbitrary commands by sending a long, specially crafted POST request. 

### Resolution

Apply a fix when available. 

### References

http://secunia.com/advisories/31146/   


### Limitations

Exploit works on WebLogic Server 10.0. On Windows Server 2003, patch KB933729 (rpcrt4.dll version 5.2.3790.4115) must be installed. 

### Platforms

Windows 2000  
Windows Server 2003