del.icio.us
Slashdot
reddit
Newsvine
|
Oracle Releases Security Alert CVE-2010-0073 for WebLogic Server Vulnerability February 8, 2010
This Security Alert addresses security issue CVE-2010-0073, a
vulnerability in the Node Manager component of Oracle WebLogic Server.
This vulnerability may be remotely exploitable without authentication,
i.e. it may be exploited over a network without the need for a username
and password. A knowledgeable and malicious remote user can exploit this
vulnerability
which can result in impacting the availability, integrity and
confidentiality of the targeted system. Patches and relevant information for protection
against this vulnerability can be found at: https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1058764.1 Oracle strongly recommends that the fix for
this vulnerability be applied as soon as possible. Oracle also strongly recommends that you backup
and comprehensively test the stability of your system upon application
of any patch or workaround prior to deleting any of the original file(s)
that are replaced by a patch or workaround. It is also strongly
recommended that customers apply January 2010 and earlier Critical Patch
Updates. Oracle WebLogic Server Critical Patch Update patches are
cumulative at sub-component level (e.g. WLS console, Web application,
Node Manager are sub-components). The January 2010 Critical Patch Update
patches include all the security fixes released since the July 2009
Critical Patch Update. The patches in January 2010 Critical Patch Update
do not include all the earlier advisories prior to July 2009 Critical
Patch Update (unless otherwise noted). So, WebLogic Server customers
should refer to
Previous Security Advisories
to identify previous security fixes they want to apply. Note:
MitigationRestricting access to the Node Manager port through firewalls or other network access controls will prevent the exploitation of this vulnerability by anonymous Internet users. In addition, organizations should consider updating their policies to permit access to this port only by trusted subnet/users. References
Modification History
|
Terms of Use | Copyright © 2002 - 2010 CONSTITUENTWORKS SM CORPORATION. All rights reserved. | Privacy Statement
Oracle
has released a security alert to address a vulnerability in Oracle
WebLogic Server. Exploitation of this vulnerability may allow a remote,
unauthenticated attacker to execute arbitrary commands on an affected
system.