def-2000-04: Bea WebLogic Server dotdot-overflow

[Peter Gründl <peter.grundl () DEFCOM COM>]

======================================================================
                  Defcom Labs Advisory def-2000-04

                 Bea WebLogic Server dotdot-overflow

Author: Peter Gründl <peter.grundl () defcom com>
Release Date: 2000-12-19
======================================================================
------------------------=[Brief Description]=-------------------------
It is possible to trigger a race condition that can result in the
stack and registers being partially overwritten.

------------------------=[Affected Systems]=--------------------------
Bea WebLogic Server for Windows NT prior to V5.1.0 - Service Pack 7

----------------------=[Detailed Description]=------------------------
WebLogic Server has a specific handler for URL requests that start
with "dotdot". By sending a large URL (..aaaaaaaaaaaaaaaaaaxlots more)
and disconnecting, it is possible to trigger a buffer overflow. The
result can be anywhere from crashing the web server, to executing
arbitrary code on the server with the privileges of the web server
(which usually means LocalSystem).

---------------------------=[Workaround]=-----------------------------
Upgrade to Bea Weblogic 5.1.0, Service Pack 7:
http://commerce.beasys.com/downloads/weblogic_server.jsp

-------------------------=[Vendor Response]=--------------------------
This issue was brought to the vendor's attention on the 20th of
November, and notification of a fix was received by Defcom on the 19th
of December.

======================================================================
            This release was brought to you by Defcom Labs

              labs () defcom com             www.defcom.com
======================================================================