Oracle working on out-of-cycle fix for WebLogic flaw

Oracle is warning of a serious vulnerability impacting the Apache web server plug-in for Oracle WebLogic, a widely deployed platform used for server programming in Java.

The database giant on Monday issued an alert warning users about the zero-day bug, for which public exploit code exists in underground forums. This marks the first time Oracle released a security alert since it introduced quarterly patch updates in January 2005.

Successful exploit could enable a remote attacker to "compromise the confidentiality or integrity of WebLogic Server applications or cause a denial-of-service condition," according to a US-CERT advisory.

The flaw and ensuing exploit code was released soon after the latest quarterly update, delivered July 15. As a result, Oracle plans to issue an out-of-cycle fix for the bug, Eric Maurice, security manager in Oracle's global technology business unit, said on the company's Global Product Security blog.

"Unfortunately, the person(s) who published this vulnerability and associated exploit codes did not contact Oracle before publicly disclosing this issue," Maurice wrote.

"This means that the vulnerability was made public before providing Oracle an opportunity to develop an appropriate fix for this issue and notify its customers."

In lieu of a fix, Oracle has published a workaround and issued details to all of its WebLogic customers, Maurice said.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition

fixflawforonoraclesecurityweblogicworking