Out-of-band security advisory addresses second Oracle WebLogic Server vulnerability in two months. Background On June 18, Oracle published an out-of-band security advisory to address a critical vulnerability in Oracle WebLogic Server.

CVE-2019-2729: Oracle Releases Out-of-Band Patch for WebLogic Server Deserialization Vulnerability

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A vulnerability in Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0 & 12.2.1.3.0 allows an unauthenticated attacker with HTTP access to the service to obtain arbitrary code execution due to an insecure deserialization.

Oracle proposes the associated patches on its site to fix the vulnerability.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - An unspecified vulnerability allows a remote unauthenticated     attacker with network access to compromise and takeover the     StorageTek Tape Analytics SW Tool. (CVE-2019-2725) (CVE-2019-2729)

  - An unspecified vulnerability allows a remote unauthenticated     attacker with network access to compromise and takeover the     Tape Virtual Storage Manager GUI. (CVE-2019-2725)

  - An unspecified vulnerability in the WLS Core Component allows an     authenticated low privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized update, insert or delete access to Oracle     WebLogic Server accessible data. (CVE-2019-2824) (CVE-2019-2827)

  - An unspecified vulnerability in the jQuery Component allows an     authenticated low privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized update, insert or delete access to Oracle     WebLogic Server accessible data. Successful attacks require     human interaction from actions from another Weblogic user.
    (CVE-2016-71030)

  - An unspecified vulnerability in the Application Container - JavaEE     Component of Oracle WebLogic Server allows an unauthenticated     attacker with network access via T3 to compromise Oracle WebLogic     Server. A successful attack of this vulnerability could result in     takeover of Oracle WebLogic Server. (CVE-2019-2856)     
  - An unspecified vulnerability in the Sample apps (Spring Framework)     Component of Oracle WebLogic Server allows an unauthenticated     attacker with network access via HTTP to compromise Oracle WebLogic     Server. A successful attack of this vulnerability could result in     unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle WebLogic Server. (CVE-2018-15756)

The Oracle WebLogic server is affected by a remote code execution vulnerability in wls9_async_response.war and wls-wsat.war packages due to unsafe deserialization of Java objects. A remote unauthenticated attacker can exploit the issue by sending a custom Java serialized object via HTTP request to execute arbitrary Java code in the context of the web server.

Note: This plugin is only effective against Weblogic Server 10.3.6

According to its self-reported version number, the version of   Oracle WebLogic Server running on the remote host is affected by a remote code execution vulnerability in its Web   Services component due to a deserialization vulnerability. An unauthenticated, remote attacker can exploit this to   bypass authentication and execute arbitrary commands.

The remote host is running a version of Oracle WebLogic Server that is affected by multiple RCE vulnerabilities:

 - A vulnerability exists that allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2018-2628)
 - A deserialization vulnerability via XMLDecoder exists in Oracle WebLogic Server Web Services. This remote code execution vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. (CVE-2019-2729)

ID	Name	Product	Family	Type	Severity
112706	Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
126915	Oracle WebLogic Server Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Misc.	Local	critical
126262	Oracle WebLogic Server Deserialization RCE (CVE-2019-2729)	Nessus	Web Servers	Remote	critical
126051	Oracle WebLogic Server Web Services Remote Code Execution Vulnerability	Nessus	Misc.	Local	critical
700244	Oracle WebLogic Multiple Java Object Deserialization RCE	Nessus Network Monitor	Web Servers		critical

Detections

Analytics

CVE-2019-2729

critical

Tenable Plugins

critical

critical

critical

critical

critical