Patch/Configuration Management, Vulnerability Management

Oracle patches “Apache Killer” flaw in HTTP Server

Oracle on Thursday issued an emergency patch to fix a flaw, known as “Apache Killer,” that could allow attackers to crash its HTTP Server products based on Apache 2.0 or 2.2.

The vulnerability was discovered in the Apache HTTP Server and affects several Oracle offerings through the company's implementation of Apache, Eric Maurice, software security assurance director at Oracle, wrote in a blog post Thursday. The database giant decided to fix the flaw ahead of its next patch update, scheduled for Oct. 18, due to the “criticality of this vulnerability and particularly its ease of exploitation,” Maurice wrote.

The flaw can be remotely exploited to bring down HTTP servers without authentication, or the need for a username and password, according to Oracle's security alert.

“This vulnerability allows a malicious attacker to hang the Oracle HTTP Server product via an easy-to-deploy, unauthenticated network attack,” Maurice wrote.

Affected products include Oracle Fusion Middleware 11g Release 1, versions 11.1.1.3.0, 11.1.1.4.0, 11.1.1.5.0; Oracle Application Server 10g Release 3, version 10.1.3.5.0; and Oracle Application Server 10g Release 2, version 10.1.2.3.0.

The flaw is listed with a Common Vulnerability Scoring System (CVSS) severity rating of 7.8 on the U.S. government's National Vulnerability Database, indicating it could allow for complete operating system denial-of- service (DoS). Oracle, however, assigned the flaw a lower rating.

“A complete operating system denial-of-service is not possible on any platform supported by Oracle, and as a result, Oracle has given the vulnerability a CVSS base score of 5.0 indicating a complete DoS of the Oracle HTTP Server, but not the operating system,” Oracle said.

The bug was originally disclosed in August on the Full Disclosure security mailing list by a user with the handle "Kingcope." Apache, on Aug. 31, fixed the vulnerability with its release of Apache version 2.2.2. IBM subsequently issued a patch for its HTTP Server for IBM i, which is also based on the Apache web server.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.