Researchers Analyze Oracle WebLogic Flaw Under Attack
Trend Micro researchers explain how attackers bypassed the patch for a deserialization vulnerability in the Oracle WebLogic Server.
Oracle recently urged customers to deploy its April 2020 Critical Patch Update to address CVE-2020-2883, a vulnerability affecting multiple versions of the Oracle WebLogic Server. Both the company and US-CERT published warnings to inform users the flaw was under active attack.
Now researchers with Trend Micro's Zero-Day Initiative (ZDI) have published an analysis of the bug. Earlier this year, a deserialization vulnerability in the Oracle WebLogic Server was patched by Oracle and assigned CVE-2020-2555. Later on, security researcher Quynh Le of VNPT ISC found a flaw showing how an attacker might bypass the first bug. The second flaw received the label CVE-2020-2883 and is now being exploited in the wild, ZDI researcher Sivathmican Sivakumaran explains.
Cybercriminals are using CVE-2020-2883 to target unpatched servers, US-CERT warns. In an analysis, Sivakumaran notes this flaw is in the Coherence library. "Any application with the Coherence library in its code path where there is a path to deserialization is also vulnerable," he states. An example is Oracle Business Intelligence, which is deployed on Oracle WebLogic.
Oracle does not mention how widespread the attacks are but emphasizes the importance of patching and offers guidance on how to restrict the T3/T3S protocol traffic for WebLogic Server. The company will release its next batch of security fixes on July 14.
Read more details about the vulnerability in Sivakumaran's blog post here.
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really bad day" in cybersecurity. Click for more information and to register.
About the Author
You May Also Like
Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response
Nov 20, 2024