Trend Micro researchers explain how attackers bypassed the patch for a deserialization vulnerability in the Oracle WebLogic Server.
Oracle recently urged customers to deploy its April 2020 Critical Patch Update to address CVE-2020-2883, a vulnerability affecting multiple versions of the Oracle WebLogic Server. Both the company and US-CERT published warnings to inform users the flaw was under active attack.
Now researchers with Trend Micro's Zero-Day Initiative (ZDI) have published an analysis of the bug. Earlier this year, a deserialization vulnerability in the Oracle WebLogic Server was patched by Oracle and assigned CVE-2020-2555. Later on, security researcher Quynh Le of VNPT ISC found a flaw showing how an attacker might bypass the first bug. The second flaw received the label CVE-2020-2883 and is now being exploited in the wild, ZDI researcher Sivathmican Sivakumaran explains.
Cybercriminals are using CVE-2020-2883 to target unpatched servers, US-CERT warns. In an analysis, Sivakumaran notes this flaw is in the Coherence library. "Any application with the Coherence library in its code path where there is a path to deserialization is also vulnerable," he states. An example is Oracle Business Intelligence, which is deployed on Oracle WebLogic.
Oracle does not mention how widespread the attacks are but emphasizes the importance of patching and offers guidance on how to restrict the T3/T3S protocol traffic for WebLogic Server. The company will release its next batch of security fixes on July 14.
Read more details about the vulnerability in Sivakumaran's blog post here.
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really bad day" in cybersecurity. Click for more information and to register.
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024