BEA WebLogic Server and Express XML parser denial of service
| weblogic-xml-parser-dos (25348) |  Low Risk |
Description:
BEA WebLogic Server and Express is vulnerable to a denial of service attack, caused by improper handling of non-canonicalized XML documents by the XML parser. A remote attacker could create a specially-crafted XML document which, once processed by the affected server, would cause the consumption of all available memory resources.
Platforms Affected:
- BEA, WebLogic Server 6.1 SP7 Express
- BEA, WebLogic Server 6.1 SP7
- BEA, WebLogic Server 7.0 SP6 Express
- BEA, WebLogic Server 7.0 SP6
- BEA, WebLogic Server 8.1 SP4
- BEA, WebLogic Server 8.1 SP4 Express
Remedy:
Refer to BEA Systems Inc. Security Advisory: (BEA06-123.00) for patch and upgrade information. See References.
Consequences:
Denial of Service
References:
- BEA Systems Inc. Security Advisory: (BEA06-123.00), Certain XML documents can cause "server out of memory" errors. at https://support.bea.com/application_content/product_portlets/securityadvisories/183.html.
- BID-17167: BEA WebLogic Server Remote Denial Of Service Vulnerability
- CVE-2006-1352: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents.
- SA19310: BEA WebLogic Server/Express Two Vulnerabilities
- SECTRACK ID: 1015790: WebLogic XML Document Parsing Memory Error Lets Remote Users Deny Service
- VUPEN/ADV-2006-1021: BEA WebLogic Server and Express Security Bypass and Denial of Service
Reported:
Mar 20, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net