Oracle Security Alert for CVE-2008-3257

Description

This Security Alert addresses the security issue CVE-2008-3257, a vulnerability in the Apache Connector component (mod_weblogic) of the Oracle Weblogic Server (formerly BEA WebLogic Server). This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A knowledgeable and malicious remote user can exploit this vulnerability with resulting availability, integrity and confidentiality impact.
 

Supported Products and Components Affected

Patch Availability

Patches for this vulnerability can be found at the following:

  http://www.oracle.com/technology/deploy/security/wls-security/2793.html

Oracle strongly recommends that you backup and comprehensively test the stability of your system upon application of any patch or workaround prior to deleting any of the original file(s) that are replaced by a patch or workaround.
 

Risk Matrix

Workarounds

Oracle recommends that patches be applied rather than workarounds.  Workarounds published by Oracle before patches were made available can be found at:

  http://www.oracle.com/technology/deploy/security/wls-security/2793.html
 

• Oracle Critical Patch Updates and Security Alerts main page  [ Oracle Technology Network ]
• Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions [ CPU FAQ ]  
• Risk Matrix definitions   [ Risk Matrix Definitions ]
• Use of Common Vulnerability Scoring System (CVSS) by Oracle   [ Oracle CVSS Scoring ]
• List of public vulnerabilities fixed in Critical Patch Updates and Security Alerts   [ Oracle Technology Network ]
• Software Error Correction Support Policy   [MetaLink Note 209768.1 ]
• Security Advisories Notifications for BEA products   [BEA Security Advisories ]

Modification History