Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU) - Nessus

High   Plugin ID: 88053

---

This page contains detailed information about the Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 88053
Name: Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU)
Filename: oracle_weblogic_server_cpu_jan_2016.nbin
Vulnerability Published: 2014-03-24
This Plugin Published: 2016-01-21
Last Modification Time: 2022-05-03
Plugin Version: 1.269
Plugin Type: local
Plugin Family: Misc.
Dependencies: oracle_weblogic_server_installed.nbin
Required KB Items [?]: installed_sw/Oracle WebLogic Server

Vulnerability Information

---

Severity: High
Vulnerability Published: 2014-03-24
Patch Published: 2016-01-19
CVE [?]: CVE-2014-0107, CVE-2015-4852, CVE-2016-0464, CVE-2016-0572, CVE-2016-0573, CVE-2016-0574, CVE-2016-0577
CPE [?]: cpe:/a:oracle:fusion_middleware, cpe:/a:oracle:weblogic_server
Exploited by Malware: True
In the News: True

Synopsis

An application server installed on the remote host is affected by multiple vulnerabilities.

Description

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :

- The Sites subcomponent is affected by a security bypass vulnerability in the Apache Xalan-Java library due to a failure to properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled. A remote attacker can exploit this to bypass restrictions and load arbitrary classes or access external resources. (CVE-2014-0107)

- The WLS Security component is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. A remote attacker, via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, can exploit this to execute arbitrary commands. (CVE-2015-4852)

- An unspecified vulnerability exists in the WLS-Console subcomponent that allows a remote attacker to affect the integrity of the system. No other details are available. (CVE-2016-0464)

- An unspecified vulnerability exists in the Coherence Container subcomponent that allows a remote attacker to affect the confidentiality, integrity, and availability of the system. No other details are available. (CVE-2016-0572)

- An unspecified vulnerability exists in the WLS Java Messaging Service subcomponent that allows a remote attacker to affect the confidentiality, integrity, and availability of the system. No other details are available. (CVE-2016-0573)

- Multiple unspecified vulnerabilities exist in the WLS Core Components subcomponent that allow a remote attacker to affect the confidentiality, integrity, and availability of the system. No other details are available. (CVE-2016-0574, CVE-2016-0577)

Solution

Apply the appropriate patch according to the January 2016 Oracle Critical Patch Update advisory.

Public Exploits

---

Target Network Port(s): N/A
Target Asset(s): N/A
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub, Immunity Canvas, Core Impact)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU) vulnerability:

1. Metasploit: exploit/multi/misc/weblogic_deserialize_rawobject
   [Oracle Weblogic Server Deserialization RCE - Raw Object]
2. Exploit-DB: exploits/java/remote/42806.py
   [EDB-42806: Oracle WebLogic Server 10.3.6.0 - Java Deserialization Remote Code Execution]
3. Exploit-DB: exploits/multiple/remote/46628.rb
   [EDB-46628: Oracle Weblogic Server Deserialization RCE - Raw Object (Metasploit)]
4. GitHub: https://github.com/eliasgranderubio/4depcheck
   [CVE-2014-0107]
5. GitHub: https://github.com/eliasgranderubio/dagda
   [CVE-2014-0107]
6. GitHub: https://github.com/AndersonSingh/serialization-vulnerability-scanner
   [CVE-2015-4852: CVE-2015-4852 Oracle WebLogic Scanner]
7. GitHub: https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
   [CVE-2015-4852]
8. GitHub: https://github.com/MrTcsy/Exploit
   [CVE-2015-4852]
9. GitHub: https://github.com/Y4tacker/JavaSec
   [CVE-2015-4852]
10. GitHub: https://github.com/asa1997/topgear_test
    [CVE-2015-4852]
11. GitHub: https://github.com/awsassets/weblogic_exploit
    [CVE-2015-4852]
12. GitHub: https://github.com/cross2to/betaseclab_tools
    [CVE-2015-4852]
13. GitHub: https://github.com/fengjixuchui/RedTeamer
    [CVE-2015-4852]
14. GitHub: https://github.com/followboy1999/weblogic-deserialization
    [CVE-2015-4852]
15. GitHub: https://github.com/hanc00l/weblogic_unserialize_exploit
    [CVE-2015-4852]
16. GitHub: https://github.com/hashtagcyber/Exp
    [CVE-2015-4852]
17. GitHub: https://github.com/koutto/jok3r-pocs
    [CVE-2015-4852]
18. GitHub: https://github.com/lovechinacoco/https-github.com-mai-lang-chai-Middleware-Vulnerability-detection
    [CVE-2015-4852]
19. GitHub: https://github.com/nex1less/CVE-2015-4852
    [CVE-2015-4852]
20. GitHub: https://github.com/nihaohello/N-MiddlewareScan
    [CVE-2015-4852]
21. GitHub: https://github.com/roo7break/serialator
    [CVE-2015-4852: Python script to exploit CVE-2015-4852.]
22. GitHub: https://github.com/sourcery-ai-bot/Deep-Security-Reports
    [CVE-2015-4852]
23. GitHub: https://github.com/tdtc7/qps
    [CVE-2015-4852]
24. GitHub: https://github.com/zema1/oracle-vuln-crawler
    [CVE-2015-4852]
25. GitHub: https://github.com/zhzhdoai/Weblogic_Vuln
    [CVE-2015-4852: CVE-2015-4852、CVE-2016-0638、CVE-2016-3510、CVE-2019-2890漏洞POC]
26. Immunity Canvas: CANVAS

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS Score Source [?]: CVE-2016-0577
CVSS V2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C

CVSS Base Score:	7.5 (High)
Impact Subscore:	6.4
Exploitability Subscore:	10.0
CVSS Temporal Score:	6.5 (Medium)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	6.5 (Medium)

STIG Severity [?]: I
STIG Risk Rating: High

Go back to menu.

Plugin Source

---

The oracle_weblogic_server_cpu_jan_2016.nbin Nessus plugin is distributed in a propriatory binary format and its source code is protected. This script is Copyright (C) 2016-2022 and is owned by Tenable, Inc. or an Affiliate thereof.

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/oracle_weblogic_server_cpu_jan_2016.nbin
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\oracle_weblogic_server_cpu_jan_2016.nbin
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/oracle_weblogic_server_cpu_jan_2016.nbin

Go back to menu.

How to Run

---

Here is how to run the Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select Misc. plugin family.
6. On the right side table select Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU) plugin ID 88053.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl oracle_weblogic_server_cpu_jan_2016.nbin -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a oracle_weblogic_server_cpu_jan_2016.nbin -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - oracle_weblogic_server_cpu_jan_2016.nbin -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state oracle_weblogic_server_cpu_jan_2016.nbin -t <IP/HOST>

Go back to menu.

References

---

BID | SecurityFocus Bugtraq ID:

• 66397, 77539

IAVA | Information Assurance Vulnerability Alert:

• 2015-A-0287

CERT | Computer Emergency Response Team:

• 576313

See also:

• https://www.tenable.com/plugins/nessus/88053
• http://www.nessus.org/u?9c6d83db
• http://www.nessus.org/u?d13bbe45
• http://www.nessus.org/u?e0203be3
• https://vulners.com/nessus/ORACLE_WEBLOGIC_SERVER_CPU_JAN_2016.NBIN

Similar and related Nessus plugins:

• 73653 - Amazon Linux AMI : xalan-j2 (ALAS-2014-325)
• 73309 - CentOS 5 / 6 : xalan-j2 (CESA-2014:0348)
• 73216 - Debian DSA-2886-1 : libxalan2-java - security update
• 87432 - F5 Networks BIG-IP : Java commons-collections library vulnerability (K30518307)
• 73356 - Fedora 19 : xalan-j2-2.7.1-22.fc19 (2014-4426)
• 73359 - Fedora 20 : xalan-j2-2.7.1-22.fc20 (2014-4443)
• 90340 - GLSA-201604-02 : Xalan-Java: Arbitrary code execution
• 76336 - openSUSE Security Update : xalan-j2 (openSUSE-SU-2014:0861-1)
• 73294 - Oracle Linux 5 / 6 : xalan-j2 (ELSA-2014-0348)
• 88044 - Oracle WebCenter Sites Apache Xalan-Java Library Security Bypass (January 2016 CPU)
• 87209 - Oracle WebLogic Server Java Object Deserialization RCE (Local Check)
• 73295 - RHEL 5 / 6 : xalan-j2 (RHSA-2014:0348)
• 73796 - RHEL 5 / 6 : JBoss EAP (RHSA-2014:0453)
• 74300 - RHEL 5 / 6 : JBoss EAP (RHSA-2014:0591)
• 119149 - Tenable SecurityCenter < 5.8.0 Multiple Vulnerabilities (TNS-2018-15)
• 73296 - Scientific Linux Security Update : xalan-j2 on SL5.x, SL6.x i386/x86_64 (20140401)
• 76373 - SuSE 11.3 Security Update : xalan-j2 (SAT Patch Number 9426)
• 74137 - Ubuntu 10.04 LTS / 12.04 LTS / 13.10 : libxalan2-java vulnerability (USN-2218-1)
• 87011 - Oracle WebLogic Java Object Deserialization RCE
• 89053 - AIX Java Advisory : java_jan2016_advisory.asc (January 2016 CPU) (SLOTH)
• 86658 - Oracle MySQL 5.5.x < 5.5.46 Multiple Vulnerabilities (October 2015 CPU) (January 2016 CPU) (July 2016 CPU)
• 88380 - Oracle MySQL 5.5.x < 5.5.47 Multiple Vulnerabilities (January 2016 CPU) (April 2016 CPU)
• 86661 - Oracle MySQL 5.6.x < 5.6.27 Multiple Vulnerabilities (October 2015 CPU) (January 2016 CPU) (July 2016 CPU)
• 88383 - Oracle MySQL 5.6.x < 5.6.28 Multiple Vulnerabilities (January 2016 CPU)
• 88384 - Oracle MySQL 5.7.x < 5.7.10 Multiple Vulnerabilities (January 2016 CPU)
• 88043 - Oracle Enterprise Manager Cloud Control Multiple Vulnerabilities (January 2016 CPU)
• 88045 - Oracle Java SE Multiple Vulnerabilities (January 2016 CPU) (SLOTH)
• 88046 - Oracle Java SE Multiple Vulnerabilities (January 2016 CPU) (SLOTH) (Unix)
• 88049 - Oracle Secure Global Desktop Multiple Vulnerabilities (January 2016 CPU) (Logjam)
• 88086 - Oracle WebLogic Portal Apache Commons File Upload (January 2016 CPU)

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file oracle_weblogic_server_cpu_jan_2016.nbin version 1.269. For more plugins, visit the Nessus Plugin Library.

Go back to menu.