CVE-2008-4008 Memory corruption in n/a

Critical 10.0 Published 14 Oct 2008 Updated 7 Aug 2024

Remote attackers can exploit a stack-based buffer overflow in the WebLogic Apache Connector to execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2008-4008?

CVE-2008-4008 is a critical memory corruption vulnerability in n/a, published on 14 Oct 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.

Which versions are affected by CVE-2008-4008?

It affects 1 product.

Products include Oracle Bea Product Suite.

How do I fix CVE-2008-4008?

No fix has been published for CVE-2008-4008 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2008-4008 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-4008 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Sources

Also known as GHSA-xr79-9mqh-j474.