Oracle HTTP Server: Denial of service - Remote/unauthenticated

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2011.0080
                         Oracle HTTP Server update
                             19 September 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Oracle HTTP Server
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Denial of Service -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2011-3192  
Member content until: Wednesday, October 19 2011
Reference:            ASB-2011.0076.2
                      ESB-2011.0901
                      ESB-2011.0870.2

OVERVIEW

        Oracle has released an update to Oracle HTTP Server correcting the
        recent Apache HTTPD vulnerability. [1]


IMPACT

        The vulnerability allows for a remote attacker to cause a denial of
        service in Oracle HTTP Server products based on Apache 2.0 or 2.2. [1]


MITIGATION

        Oracle has released a security fix, and recommends that customers
        apply it as soon as possible. [1]


REFERENCES

        [1] Oracle Security Alert for CVE-2011-3192
            http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTnbR0O4yVqjM2NGpAQI7NA/+NqaoLxUE/JEsaMlx8s9SOEFGUTMaepPI
Xfm+SvfuydSC0qvdQJAdhlwA1d6l7Z06B8yRQk4gFR63TpzAKiG/wzzriFgsq5O8
OOnnKaPuE/QV0RFReA5AacNnAfIwddDLWWpqXPLLJvIL3rkgEh21Tf/TpDjsgBBv
f3H5fTTqmNmfG8ggke2vUE0pahNkr6A8XPTtZ6HUdlelm9wtR5pZYeWW8xhFxBas
tOm3sK6LPdauaAVlfOO13SgRz0kaMeFNNzAtC6GBPFohMvjkFMtu4Hrxa4mkWnkB
ZQsjRLtU2iL34/YYTRXzxbaGR6DRuMSx6+VL0ZGOf9FZvGoCUjAQl0fS2mmtW8sf
NH0Q+RZHaiWoawE3tJlv6+FlyuHINQnUjpv1QRk1yhCn033T/p6+LVsU+oSSQiKC
VKKBhD7WYZ5q5x/eQKCcLYi1iSX08oPszCOSa9Tt1y3NKEhylKZ0VqKB5HDht9H/
RR1CTgE1ZJqmUIQsTvsE2GJZXtS2w/Vm1QiWHdA/ZJ5LCBO2NkFzk0ymM/i26bAl
SI+9zIQ1hC6vmCd/qvspLk0EMS22IpVWEMS2XmZ20NkV6yHkIG9jSnz9xMhORoeD
SE7Bw+2BQUHm6aOGM2vQI/H5Yl35QJjhZDPKdFubQ/X4OI561XZxSIE/duUTqtdT
e7xhAFehvTg=
=Fj85
-----END PGP SIGNATURE-----