BEA Web Logic plug-in for Apache JSESSION Cookie overflow
Summary: A buffer overflow exists in the Apache plug-in connector for BEA WebLogic, caused by an incorrectly bounded strncpy that copies the length of the JSESSIONID cookie value rather than the length of the fixed-size destination buffer on the stack. The flaw, tracked as CVE-2008-5457, was reported to Oracle on 10/22/08, detected by Snort/Sourcefire since 10/22/08 under SID 15010 GID 3, and patched by Oracle in its January 2009 CPU on 01/13/09.
Key Takeaway: The vulnerability is remotely exploitable without authentication and can affect the availability, confidentiality, or integrity of WebLogic applications fronted by the Apache plug-in, and the patch is only obtainable with an Oracle Support Account.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026