Disclaimer: I am not speaking as or for the Apache Software Foundation, I am speaking entirely for my personal opinion in this post.
Oracle is suing a downstream user of Apache Harmony. Even if they are not attacking the Apache Software Foundation directly, it is a dangerous situation when downstream users are sued for Patents.
If someone was suing users or re-distributors of the Apache Web Server, HTTPD, it would be the same situation.
It is important to understand that so far, and until I see more information, most and possibly all of the patents used in litigation are related to Dalvik, and not the class libraries. Apache Harmony has its own VM, DRLVM, which is not used in Android.
I believe it is still disturbing that Oracle is aggressively using Software Patents in the open source Java Realm. It creates a chilling effect on the future of the JVM as a platform in my opinion.
Oracle has not approached the ASF -- as others have mentioned, the ASF is a 501(c)(3) non-profit foundation, and a legal battle with Oracle would decimate any money we have, and that means Oracle couldn't extract any money from us anyways.
Internally the ASF is struggling with how to respond.
There is a general consensus within the members about the dislike of Software Patents, as you find within most groups of Software Developers.
However, there is not a general consensus about what the ASF could do, if anything. The ASF could write blog posts about the general issue, we could be more aggressive on the publicity side, but all of those are like poking a Grizzly Bear with a needle and hoping it doesn't rip your arm off.
In addition, because many members of the Apache Software Foundation have been or are currently employed by both Oracle/Sun, and Google, and/or have internal knowledge of things like the JCP, it is not a 'good' thing for the ASF to speak too early in this issue and become a victim smashed between two billion dollar legal teams. It is also likely in the event of a longer legal battle, many ASF members might be called in testify, further complicating what role the ASF as a foundation should have.
Everyone believes that many large companies have dozens or even hundreds of Software Patents that could apply to the various ASF projects, and we mostly exist in a peaceful state. Oracle has certainly changed that perspective. I don't know what the foundation will do going forward.
The Oracle suit has validated the strict rules that the ASF imposes by use of Contributor License agreements, and tracking of where all our source code has come from. Some open source developers choose to ignore these problems, but good governance is an important attribute if you want to defend against things like Oracle or SCO.