Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Oracle on Thursday issued an emergency patch to fix an “Apache Killer” flaw that could allow attackers to crash its HTTP Server products based on Apache 2.0 or 2.2.
The vulnerability was discovered in the Apache HTTP Server and affects several Oracle offerings through the company's implementation of Apache, Eric Maurice, software security assurance director at Oracle, wrote in a blog post Thursday.
The database giant decided to fix the flaw ahead of its next patch update, scheduled for 18 October, due to the “criticality of this vulnerability and particularly its ease of exploitation”, Maurice wrote.
The flaw can be remotely exploited to bring down HTTP servers without authentication, or the need for a username and password, according to Oracle's security alert.
“This vulnerability allows a malicious attacker to hang the Oracle HTTP Server product via an easy-to-deploy, unauthenticated network attack,” Maurice wrote.
Affected products include Oracle Fusion Middleware 11g Release 1, versions 11.1.1.3.0, 11.1.1.4.0, 11.1.1.5.0; Oracle Application Server 10g Release 3, version 10.1.3.5.0; and Oracle Application Server 10g Release 2, version 10.1.2.3.0.
The flaw is listed with a Common Vulnerability Scoring System (CVSS) severity rating of 7.8 on the US government's National Vulnerability Database, indicating it could allow for complete operating system denial-of- service (DoS). Oracle, however, assigned the flaw a lower rating.
“A complete operating system denial-of-service is not possible on any platform supported by Oracle, and as a result, Oracle has given the vulnerability a CVSS base score of 5.0 indicating a complete DoS of the Oracle HTTP Server, but not the operating system,” Oracle said.
The bug was originally disclosed in August on the Full Disclosure security mailing list by a user with the handle "Kingcope." Apache, on Aug. 31, fixed the vulnerability with its release of Apache version 2.2.2.
IBM subsequently issued a patch for its HTTP Server for IBM i, which is also based on the Apache web server.
This article originally appeared at scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.