BEA Systems WebLogic Server DOS Device Denial of Service Vulnerability

Bugtraq ID:	3816
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-0106
Remote:	Yes
Local:	No
Published:	Jan 08 2002 12:00AM
Updated:	Jul 11 2009 09:56AM
Credit:	Discovered and posted to Bugtraq by Peter Grundl <[email protected]>.
Vulnerable:	BEA Systems Weblogic Server 6.1 SP 1 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems Weblogic Server 6.1 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc
Not Vulnerable:	BEA Systems Weblogic Server 6.1 SP 2 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc

BEA Systems WebLogic Server DOS Device Denial of Service Vulnerability

BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux vendors.

It is possible to remotely crash a system running Bea Systems WebLogic Server by submitting numerous URL requests for a MS-DOS devicename appended with a .jsp extension, such as

www.example.com/aux.jsp

A hard reboot of the exploited server will be required to restore web services.

BEA Systems WebLogic Server DOS Device Denial of Service Vulnerability

No exploit code required.

BEA Systems WebLogic Server DOS Device Denial of Service Vulnerability

Solution:
BEA Systems has addressed this issue with Service Pack 2:

http://commerce.beasys.com

BEA Systems WebLogic Server DOS Device Denial of Service Vulnerability

References:

• WebLogic Server Product Homepage (Oracle)