Oracle pushes emergency DDoS vulnerability patch

Ellison's firm pushes out a rare out-of-cycle patch to fix a DDoS vulnerability.

Patch

Oracle has issued an out-of-cycle patch for a denial of service flaw in the Apache web server, versions httpd 2.0 or 2.2, affecting a range of products.

Whilst Oracle has not given the vulnerability a high rating, it noted how easily the flaw could be exploited.

The general unwillingness of Oracle to deviate from its once-every-three-months patch cycle spells one word, Importance.'

"This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password," Oracle noted in its security advisory.

"A remote user can exploit this vulnerability to impact the availability of un-patched systems."

Larry Ellison's firm recommended IT departments update their systems as soon as possible, due to "the threat posed by a successful attack."

Products affected include Oracle's Fusion Middleware and Application Server products. Oracle Enterprise Manager is also affected if the user is running the Fusion Middleware containing the vulnerability.

The flaw emerged last month, when the Apache Software Foundation revealed the denial-of-service vulnerability affected all versions of the Apache web server.

It worked by allowing a malicious user to exploit the Range feature in Apache web servers, which enables the pausing and resuming of downloads. An attack tool was spotted in the wild, giving hackers the power to overload a server by asking it to access multiple parts of a file simultaneously.

The Apache Software Foundation has already issued two patches to fix the problem in version 2.2. It sent out an initial patch towards the end of August, before issuing another to go on top of that fix.

"However conservative you might be, if you're an Oracle user, this patch is definitely recommended in a hurry," said Sophos' Paul Ducklin, in a blog post.

"The general unwillingness of Oracle to deviate from its once-every-three-months patch cycle spells one word, Importance.'"

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

The best deals on web hosting this Black Friday
web hosting

The best deals on web hosting this Black Friday

26 Nov 2021
Sitecore XP RCE flaw is being actively exploited, ACSC warns
vulnerability

Sitecore XP RCE flaw is being actively exploited, ACSC warns

9 Nov 2021
Mitre reveals ten worst hardware security weaknesses in 2021
Hardware

Mitre reveals ten worst hardware security weaknesses in 2021

3 Nov 2021
Patch management vs vulnerability management
enterprise security

Patch management vs vulnerability management

14 Sep 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022
Solving cyber security's diversity problem
Careers & training

Solving cyber security's diversity problem

5 Jan 2022