Oracle patches "Apache Killer" flaw in HTTP Server

The vulnerability was discovered in the Apache HTTP Server and affects several Oracle offerings through the company's implementation of Apache, Eric Maurice, software security assurance director at Oracle, wrote in a blog post Thursday. The database giant decided to fix the flaw ahead of its next patch update, scheduled for Oct. 18, due to the “criticality of this vulnerability and particularly its ease of exploitation,” Maurice wrote.

The flaw can be remotely exploited to bring down HTTP servers without authentication, or the need for a username and password, according to Oracle's security alert.

“This vulnerability allows a malicious attacker to hang the Oracle HTTP Server product via an easy-to-deploy, unauthenticated network attack,” Maurice wrote.

Affected products include Oracle Fusion Middleware 11g Release 1, versions 11.1.1.3.0, 11.1.1.4.0, 11.1.1.5.0; Oracle Application Server 10g Release 3, version 10.1.3.5.0; and Oracle Application Server 10g Release 2, version 10.1.2.3.0.

The flaw is listed with a Common Vulnerability Scoring System (CVSS) severity rating of 7.8 on the U.S. government's National Vulnerability Database, indicating it could allow for complete operating system denial-of- service (DoS). Oracle, however, assigned the flaw a lower rating.

“A complete operating system denial-of-service is not possible on any platform supported by Oracle, and as a result, Oracle has given the vulnerability a CVSS base score of 5.0 indicating a complete DoS of the Oracle HTTP Server, but not the operating system,” Oracle said.

The bug was originally disclosed in August on the Full Disclosure security mailing list by a user with the handle "Kingcope." Apache, on Aug. 31, fixed the vulnerability with its release of Apache version 2.2.2. IBM subsequently issued a patch for its HTTP Server for IBM i, which is also based on the Apache web server.