Oracle Issues Emergency Update To Patch Actively Exploited WebLogic Flaw

An anonymous reader quotes a report from Ars Technica: Oracle on Tuesday published an out-of-band update patching a critical code-execution vulnerability in its WebLogic server after researchers warned that the flaw was being actively exploited in the wild. The vulnerability, tracked as CVE-2019-2729, allows an attacker to run malicious code on the WebLogic server without any need for authentication. That capability earned the vulnerability a Common Vulnerability Scoring System score of 9.8 out of 10. The vulnerability is a deserialization attack targeting two Web applications that WebLogic appears to expose to the Internet by default -- wls9_async_response and wls-wsat.war. The flaw in Oracle's WebLogic Java application servers came to light as a zero-day four days ago when it was reported by security firm KnownSec404.

Re:

[jfdavis668]

They're gonna take the law into their own hands...

Re: Weblogic law?

[Eric.pl]

I fought the Weblogic law and the Oracle law won..

FLAW not LAW

[JustAnotherOldGuy]

"Oracle Issues Emergency Update To Patch Actively Exploited WebLogic Law"

"FLAW" not "LAW".

Editors needed, apply within.

Re:

[Tablizer]

"flaw" is flawed. What an iromy.

Re:

[Anonymous Coward]

What did you expect from BlowHD?

Re:

[sad_]

would be much more insteresting if an actual law was being exploited though.

It's better that way. Mathematically.

[sabbede]

As everyone knows, one funny mistake in a headline is worth three truths. Even though the error cancels out one truth, we're still ahead by two. A.K.A - Profit!

Here comes the Judge

[Anonymous Coward]

Oracle has broken the Law.

updates are not free with them!

[Joe_Dragon]

updates are not free with them!

Uncle Larry hard at work patching his yachts

[WaffleMonster]

Normally Oracle releases updates to patch hundreds of vulnerabilities at once who get queued up for three months at a time giving attackers plenty of time to hone their script kiddy skillz before the next cycle begins.

I think Oracle should have more "courage" and just wait till the next drop like they always do.

Oh no!

[Tablizer]

All 7 users of the product are going to be so pissed.

Logic Flaw

[StormReaver]

Using Oracle's database is the logic flaw to rule them all.