CVE-2009-1012 Integer overflow in n/a

Critical 10.0 Published 15 Apr 2009 Updated 7 Aug 2024

Remote attackers can exploit an integer overflow in WebLogic Server plug-ins to cause heap-based buffer overflows, leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2009-1012?

CVE-2009-1012 is a critical vulnerability in n/a, published on 15 Apr 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.

Which versions are affected by CVE-2009-1012?

It affects 1 product.

Products include Oracle Bea Product Suite.

How do I fix CVE-2009-1012?

No fix has been published for CVE-2009-1012 yet. Limit exposure of the affected software until one is available.

Is CVE-2009-1012 being exploited?

There is no known exploitation of CVE-2009-1012 in the wild and no public exploit code.

Sources

Also known as CVE-2009-0189, GHSA-7g8r-925j-vgfh.