Oracle on Thursday issued an emergency patch to fix an “Apache Killer” flaw that could allow attackers to crash its HTTP Server products based on Apache 2.0 or 2.2.
The vulnerability was discovered in the Apache HTTP Server and affects several Oracle offerings through the company's implementation of Apache, Eric Maurice, software security assurance director at Oracle, wrote in a blog post Thursday.
The database giant decided to fix the flaw ahead of its next patch update, scheduled for 18 October, due to the “criticality of this vulnerability and particularly its ease of exploitation”, Maurice wrote.
The flaw can be remotely exploited to bring down HTTP servers without authentication, or the need for a username and password, according to Oracle's security alert.
“This vulnerability allows a malicious attacker to hang the Oracle HTTP Server product via an easy-to-deploy, unauthenticated network attack,” Maurice wrote.
Affected products include Oracle Fusion Middleware 11g Release 1, versions 11.1.1.3.0, 11.1.1.4.0, 11.1.1.5.0; Oracle Application Server 10g Release 3, version 10.1.3.5.0; and Oracle Application Server 10g Release 2, version 10.1.2.3.0.
The flaw is listed with a Common Vulnerability Scoring System (CVSS) severity rating of 7.8 on the US government's National Vulnerability Database, indicating it could allow for complete operating system denial-of- service (DoS). Oracle, however, assigned the flaw a lower rating.
“A complete operating system denial-of-service is not possible on any platform supported by Oracle, and as a result, Oracle has given the vulnerability a CVSS base score of 5.0 indicating a complete DoS of the Oracle HTTP Server, but not the operating system,” Oracle said.
The bug was originally disclosed in August on the Full Disclosure security mailing list by a user with the handle "Kingcope." Apache, on Aug. 31, fixed the vulnerability with its release of Apache version 2.2.2.
IBM subsequently issued a patch for its HTTP Server for IBM i, which is also based on the Apache web server.
This article originally appeared at scmagazineus.com
Copyright © SC Magazine, US edition
Issue: 315 | May 2013
Access CRN's extensive online resources including; email bulletins, community discussions and unique online news.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can log on to the CRN website or start posting comments on articles.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain '@crn.com.au' to your white-listed senders.
