Oracle warned customers on Thursday that threat actors have been spotted attempting to exploit multiple recently patched vulnerabilities, including a critical WebLogic Server flaw tracked as CVE-2020-2883.
Eric Maurice, director of security assurance at Oracle, said the company had received “reports of attempts to maliciously exploit a number of recently-patched vulnerabilities.” He only mentioned CVE-2020-2883, but advised customers to install the latest patches as soon as possible.
Oracle’s April 2020 Critical Patch Update (CPU) resolves nearly 400 vulnerabilities, including CVE-2020-2883, a critical flaw in Oracle WebLogic Server that can be exploited by an unauthenticated attacker for remote code execution.
Oracle has credited several people for independently reporting this vulnerability, including Bui Duong from Viettel Cyber Security, Jang of VNPT ISC, Kaki King, lufei from Qi An Xin Group, and Quynh Le of VNPT ISC.
Quynh Le reported his findings to Oracle through Trend Micro’s Zero Day Initiative (ZDI), which recently published advisories describing two variants of CVE-2020-2883 identified by the researcher in February and March.
“The specific flaw exists within the handling of the T3 protocol. Crafted data in a T3 protocol message can trigger the deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process,” ZDI’s advisory reveals.
CVE-2020-2883 is one of the several WebLogic Server vulnerabilities for which a researcher claims to have published proof-of-concept (PoC) code.
It’s not uncommon for malicious actors to exploit Oracle WebLogic vulnerabilities in their attacks, in some cases even before a patch is released by Oracle.
Related: New Sodinokibi Ransomware Delivered via Oracle WebLogic Flaw
Related: Critical Oracle WebLogic Vulnerability Exploited in Attacks
Related: Hackers Target Poorly Patched Oracle WebLogic Flaw
Related: Muhstik Botnet Exploits Recent Oracle WebLogic Vulnerability
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
- Intel Launches New Attestation Service as Part of Trust Authority Portfolio
- Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems
Latest News
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- Air Canada Says Employee Information Accessed in Cyberattack
- BIND Updates Patch Two High-Severity DoS Vulnerabilities
- Faster Patching Pace Validates CISA’s KEV Catalog Initiative
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
