Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU)
high Nessus Plugin ID 88053
Language:
Synopsis
An application server installed on the remote host is affected by multiple vulnerabilities.Description
The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :- The Sites subcomponent is affected by a security bypass vulnerability in the Apache Xalan-Java library due to a failure to properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled. A remote attacker can exploit this to bypass restrictions and load arbitrary classes or access external resources.
(CVE-2014-0107)
- The WLS Security component is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. A remote attacker, via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, can exploit this to execute arbitrary commands. (CVE-2015-4852)
- An unspecified vulnerability exists in the WLS-Console subcomponent that allows a remote attacker to affect the integrity of the system. No other details are available. (CVE-2016-0464)
- An unspecified vulnerability exists in the Coherence Container subcomponent that allows a remote attacker to affect the confidentiality, integrity, and availability of the system. No other details are available.
(CVE-2016-0572)
- An unspecified vulnerability exists in the WLS Java Messaging Service subcomponent that allows a remote attacker to affect the confidentiality, integrity, and availability of the system. No other details are available. (CVE-2016-0573)
- Multiple unspecified vulnerabilities exist in the WLS Core Components subcomponent that allow a remote attacker to affect the confidentiality, integrity, and availability of the system. No other details are available. (CVE-2016-0574, CVE-2016-0577)
Solution
Apply the appropriate patch according to the January 2016 Oracle Critical Patch Update advisory.See Also
http://www.nessus.org/u?d13bbe45
Plugin Details
Severity: High
ID: 88053
File Name: oracle_weblogic_server_cpu_jan_2016.nbin
Version: 1.270
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 1/21/2016
Updated: 5/9/2022
Supported Sensors: Nessus Agent
Risk Information
CVSS Score Source: CVE-2016-0577
VPR
Risk Factor: Critical
Score: 10
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:H/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:fusion_middleware, cpe:/a:oracle:weblogic_server
Required KB Items: installed_sw/Oracle WebLogic Server
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/19/2016
Vulnerability Publication Date: 3/24/2014
CISA Known Exploited Dates: 5/3/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Oracle Weblogic Server Deserialization RCE - Raw Object)
Reference Information
CVE: CVE-2014-0107, CVE-2015-4852, CVE-2016-0464, CVE-2016-0572, CVE-2016-0573, CVE-2016-0574, CVE-2016-0577
CERT: 576313
IAVA: 2015-A-0287