Oracle pushes emergency DDoS vulnerability patch

Oracle has issued an out-of-cycle patch for a denial of service flaw in the Apache web server, versions httpd 2.0 or 2.2, affecting a range of products.

Whilst Oracle has not given the vulneability a high rating, it noted how easily the flaw could be exploited.

“This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password,” Oracle noted in its security advisory. “A remote user can exploit this vulnerability to impact the availability of un-patched systems.” Larry Ellison’s firm recommended IT departments update their systems as soon as possible, due to “the threat posed by a successful attack.”