[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
- read forum
- new topic
- search

- meetings list
- recent additions
- add your info
 top 100 sites
- visit top sites
- sign up now
- members

- add your url
- add domain
- search box
- link to us

- our projects
- free email
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : BEA Weblogic server proxy library vulnerabilities

Title: BEA Weblogic server proxy library vulnerabilities
Released by: CORE SDI
Date: 17th August 2000
Printable version: Click here
                               CORE SDI


                Vulnerability Report For BEA Weblogic's Proxy

Date Published: August 15, 2000

Advisory ID: CORE-081300

Bugtraq ID: 1570

CVE CAN: None currently assigned.

Title: BEA Weblogic Multiple Buffer Overflow Vulnerabilities

Class: Boundary Error Condition (Buffer Overflow)

Remotely Exploitable: Yes

Locally Exploitable: Yes

Vulnerability Description:

BEA Systems Inc. Weblogic server provides facilities to integrate it to third party web servers. This is accomplished by a plug-in that allows the third party web server to proxy requests to the Weblogic Server. As described in BEA's documentation plugins are supported for Netscape

Enterprise Server, IIS and Apache in the form of dynamically loadable



These web servers can be configured to redirect requests for servlets and JSP files to a Weblogic server running on the same or on a different host. Several buffer overflows in these plugins provided by BEA Weblogic server allow a remote attacker to execute arbitrary code on the system running the proxying web server. The net result of this is remote execution of arbitrary code as the user running the proxying server (generally root

on UNIX systems, SYSTEM on MS NT). For those interested a technical description and proof of concept follow towards the end of this advisory.

Vulnerable Packages/Systems:

In each instance the particular vulnerable binary information is

provided due to the fact that is differant for each web server/ OS.

Netscape Enterprise Webserver (NES)


NSAPI Weblogic binaries are:

NES for UNIX - libproxy.so

NES for NT - proxy30.dll, proxy35.dll, proxy36.dll

 - Solaris with NES versions 3.0 to 4.1

 - AIX with NES 3.6

 - HP-UX 10.20 with NES version 3.6

 - HP-UX 11.00 with NES version 3.6

 - Windows NT with NES versions 3.0 to 4.1

Internet Information Server (IIS)


ISAPI Weblogic binaries are:

IIS - iisproxy.dll

 - NT 4.0 with IIS 4.0

Apache Server


ISAPI Weblogic binaries are:

Apache for UNIX - mod_wl.so, mod_wl_ssl.so, mod_wl_ssl_raven.so

 - Solaris with Apache Server 1.3.9, 1.3.12

 - Linux with Apache Server 1.3.9, 1.3.12

 - HP-UX 11.00 with Apache Server 1.3.9, 1.3.12

 - C2Net Stronghold/3.0 and Covalent Raven/1.4.3

 - C2Net Stronghold/3.0 and Covalent Raven/1.4.3

 - C2Net Stronghold/3.0

 - Linux with Apache Server 1.3.9, 1.3.12

 - HP-UX 11.00 with Apache Server 1.3.9, 1.3.12

Solution/Vendor Information/Workaround:

BEA advises the following:

Version: BEA WebLogic Server and Express 5.1.x, 4.5.x standalone version or as part of BEA WebLogic Enterprise 5.1 on all OS platforms

Action : Upgrade the proxy plug-in used for third-party Web server integration.

         To do this, download the package at:



This package includes an updated version of the proxy plug-in for use with Netscape Enterprise Server (NES), MicrosoftInternet Information Server (IIS), and Apache Web servers. The maximum size of the buffer used to hold the computed URI path remains 2048 bytes. If a computed URI path is greater than the

size of the buffer, the proxy plug-in will report the error "414 - Request-URI Too Long" to the client as

suggested by the HTTP 1.1 specification. After downloading this package, open it and follow the instructions in your version of

the product for installation procedures. BEA strongly suggests that customers apply the remedies recommended in all their

security advisories. In addition, customers are advised to apply every Service Pack as they are released. Service Packs include a roll up of all bug fixes for each version of the product, as well as each of the previously released Service Packs.

Additionally, advisories and information on security issues

of BEA products can be obtained from:







Vendor notified on: Aug. 24th, 2000


This vulnerability was discovered by Gerardo Richarte and

Hernan Ochoa of CORE SDI S.A., Buenos Aires, Argentina.

We wish to thank BEA Systems Inc. from their prompt response to

the problem report.

This advisory was drafted with the help of the SecurityFocus.com


Help Team. For more information or assistance drafting advisories please



Technical Description - Exploit/Concept Code:

Tests were performed using iPlanet Webserver Enterprise 4.1 as the proxying web server. Following BEA documentation it was configured to proxy .JSP requests to a Weblogic server on a different host using the following configuration settings in servername/config/obj.conf:


[... text deleted ...]


Service method=(GET|HEAD|POST|PUT) type=text/jsp fn=wl-proxy\

 WebLogicHost=weblogic WebLogicPort=7001 PathPrepend=/jspfiles



The above configuration will direct the iPlanet Webserver to use the provided library (libproxy.so) to redirect the requests for files with extension .JSP to the WebLogic server listening on port 7001/tcp of the host 'weblogic' The '/jspfile' string will be prepended to the URL sent to the Weblogic host.

For example the request for 'http://webserver/test.jsp?my_parameter'


become 'http://weblogic:7001/jspfiles/test.jsp?my_parameter' and proxied

to the WebLogic server.

Handling of the requests to be proxied is made in the wl_proxy function of the libproxy.so library.

At wl_proxy+1812 there is a call to strcat() that tries to concatenate the PathPrepend argument specified in the obj.conf file with the requested URL, no bound checks are performed on the destination buffer allocated in the stack. By providing a request with more than 2100 characters long a buffer overflow condition can be exploited and arbitrary code run as the

user running the proxying web server.

Explotation of the vulnerability can be difficult due to the fact that after the overflow certain automatic variables, placed in the stack and now corrupted by the overflow, are accessed at wl_proxy+1896, before executing a ret instruction.

Also, the proxying web server performs some length checks of its own on the received request and its therefore not possible to send arbitrary long requests. However, this size limit on the proxying web server is permissive enough to let an attacker exploit the problem in the library.

The PathPrepend argument does not need to be set in order to exploit the vulnerability

Unsuccessful explotation of the problem does not lead to denial of service attacks as the web server continues normal execution.

Sample, proof of concept code:

$ perl -e 'print "GET http://webserver/test.jsp?";print "A"x2200;\

  print " HTTP/1.0\n\n"'|nc weblogic 80

note: wrapped for readability


The contents of this advisory are copyright (c) 2000 CORE SDI S.A. and

may be

distributed freely provided that no fee is charged for this distribution


proper credit is given.


"Understanding. A cerebral secretion that enables one having it to know a house from a horse by the roof on the house, It's nature and laws have been exhaustively expounded by Locke, who rode a house, and Kant, who lived in a horse." - Ambrose Bierce

==================[ CORE Seguridad de la Informacion S.A. ]=========

Iván Arce


PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836  B25D 207B E78E 2AD1 F65A

email   : iarce@core-sdi.com


Pte. Juan D. Peron 315 Piso 4 UF 17

1038 Capital Federal

Buenos Aires, Argentina.              Tel/Fax : +(54-11) 4331-5402

Casilla de Correos 877 (1000) Correo Central


(C) 1999-2000 All rights reserved.