Oracle patches 'Apache Killer' flaw

Attackers could crash HTTP Servers running Apache 2.0 or 2.2.
Oracle on Thursday issued an emergency patch to fix an “Apache Killer” flaw that could allow attackers to crash its HTTP Server products based on Apache 2.0 or 2.2.

The vulnerability was discovered in the Apache HTTP Server and affects several Oracle offerings through the company's implementation of Apache, Eric Maurice, software security assurance director at Oracle, wrote in a blog post Thursday.

The database giant decided to fix the flaw ahead of its next patch update, scheduled for 18 October, due to the “criticality of this vulnerability and particularly its ease of exploitation”, Maurice wrote.

The flaw can be remotely exploited to bring down HTTP servers without authentication, or the need for a username and password, according to Oracle's security alert.

“This vulnerability allows a malicious attacker to hang the Oracle HTTP Server product via an easy-to-deploy, unauthenticated network attack,” Maurice wrote.

Affected products include Oracle Fusion Middleware 11g Release 1, versions 11.1.1.3.0, 11.1.1.4.0, 11.1.1.5.0; Oracle Application Server 10g Release 3, version 10.1.3.5.0; and Oracle Application Server 10g Release 2, version 10.1.2.3.0.

The flaw is listed with a Common Vulnerability Scoring System (CVSS) severity rating of 7.8 on the US government's National Vulnerability Database, indicating it could allow for complete operating system denial-of- service (DoS). Oracle, however, assigned the flaw a lower rating.

“A complete operating system denial-of-service is not possible on any platform supported by Oracle, and as a result, Oracle has given the vulnerability a CVSS base score of 5.0 indicating a complete DoS of the Oracle HTTP Server, but not the operating system,” Oracle said.

The bug was originally disclosed in August on the Full Disclosure security mailing list by a user with the handle "Kingcope." Apache, on Aug. 31, fixed the vulnerability with its release of Apache version 2.2.2.

IBM subsequently issued a patch for its HTTP Server for IBM i, which is also based on the Apache web server.

This article originally appeared at scmagazineus.com