环境：Windows 2008 R2 + Oracle 10.2.0.3
应用最新bundle patch后，扫描依然报出漏洞 Oracle Database Server 'TNS Listener'远程数据投毒漏洞（CVE-2012-1675）
•1.确定解决方案
•2.应用解决方案
•3.验证修补情况
•4.Reference
1.确定解决方案
安全厂家给出的解决办法：
链接：http://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html
根据此链接得到解决方法：
|
1
2
3
4
|
SolutionRecommendations for protecting against this vulnerability can be found at:My Oracle Support Note 1340831.1 for Oracle Database deployments that use Oracle Real Application Clusters (RAC).My Oracle Support Note 1453883.1 for Oracle Database deployments that do not use RAC. |
目前这里环境不是RAC，参考文档1453883.1：
Using Class of Secure Transport (COST) to Restrict Instance Registration (文档 ID 1453883.1)
找到两种解决方案：
|
1
2
3
4
5
6
7
|
SOLUTIONThere are two methods that can be used to protect the listener using COST "SECURE_REGISTER_listener_name =" in stand alone database installations.1) Restricting registration to the TCP protocol (Requires the fix for BUG:12880299)- or - 2) Restricting registration to the IPC protocol (The patch for BUG:12880299 is NOT required for the IPC method)Either method accomplishes the same goal but it is your choice which type to implement subject to the restriction* noted below. Both methods will be discussed.•The second method (using IPC) cannot be used if the database is a member of an Oracle Data Guard broker configuration. |
我这里选择第一种解决方案：
1) Restricting registration to the TCP protocol (Requires the fix for BUG:12880299)。
2.应用解决方案
2.1 确定现状
监听配置文件：listener.ora
存放路径：cd %ORACLE_HOME%/network/admin
内容(保证安全，所有IP相关信息已二次处理)：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
# listener.ora Network Configuration File: E:\oracle\product\10.2.0\db_1\NETWORK\ADMIN\listener.ora# Generated by Oracle configuration tools.LISTENER =(DESCRIPTION_LIST =(DESCRIPTION =(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))(ADDRESS = (PROTOCOL = TCP)(HOST =192.168.1.138)(PORT = 1521))))SID_LIST_LISTENER =(SID_LIST =(SID_DESC =(SID_NAME = PLSExtProc)(ORACLE_HOME = E:\oracle\product\10.2.0\db_1)(PROGRAM = extproc)(ENVS = "EXTPROC_DLLS=ANY"))(SID_DESC =(GLOBAL = orcl)(ORACLE_HOME = E:\oracle\product\10.2.0\db_1)(SID_NAME = orcl)))ADR_BASE_LISTENER = E:\oracle |
数据库监听信息,原始都是空值：
|
1
2
3
4
5
6
7
8
9
|
SQL> show parameter local_listenerNAME TYPE VALUE------------------------------------ ----------- ---------------------------local_listener stringSQL> show parameter remote_listener;NAME TYPE VALUE------------------------------------ ----------- ---------------------------remote_listener stringSQL> |
2.2 尝试应用解决方案
2.2.1 停止监听
lsnrctl stop listener
2.2.2 修改监听配置文件
|
1
2
|
Add the COST TCP protocol restriction "SECURE_REGISTER_[listener_name] = (TCP)" to the listener.ora.Match the COST parameter variable listener_name with the name of the listener you are using in the listener.ora, e.g., If your listener name is "LISTENER_PROD" then use SECURE_REGISTER_LISTENER_PROD = (TCP) |
实际修改过程：
切换到监听配置文件所在路径：
cd %ORACLE_HOME%/network/admin
直接修改listener.ora文件，在文件的末尾添加一行：
|
1
|
SECURE_REGISTER_LISTENER = (TCP) |
2.2.3 启动监听
启动监听：
|
1
|
lsnrctl start listener |
立即注册动态监听：
|
1
|
SQL> alter system register; |
2.2.4 设置local_listener
|
1
2
|
alter system set local_listener='(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST =192.168.1.138)(PORT = 1521)))' scope = both;show parameter local_listener |
2.2.5 查看监听服务信息
|
1
2
3
4
5
|
lsnrctl services listenerE:\oracle\product\10.2.0\db_1\network\ADMIN>lsnrctl services listenerLSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 21-9月 -2016 10:22:02Copyright (c) 1991, 2006, Oracle. All rights reserved. |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))服务摘要..服务 "PLSExtProc" 包含 1 个例程。例程 "PLSExtProc", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:0 已被拒绝:0LOCAL SERVER服务 "orcl" 包含 1 个例程。例程 "orcl", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:3 已被拒绝:0LOCAL SERVER命令执行成功 |
3.验证修补情况
3.1 注释COST规则验证监听情况
3.1.1 注释掉listener.ora文件的COST规则并重启监听
|
1
|
Comment the COST rule in listener.ora and restart the listener. |
直接修改listener.ora文件,在之前添加的一行前面加上"#"注释此行。
|
1
|
#SECURE_REGISTER_LISTENER = (TCP) |
重启监听：
|
1
2
|
lsnrctl stop listenerlsnrctl start listener |
3.1.2 设置remote_listener后查看监听服务信息
设置remote_listener:
|
1
2
|
SQL> alter system set remote_listener='(ADDRESS = (PROTOCOL = TCP)(HOST =192.168.1.138)(PORT = 1521))' scope=memory;SQL> show parameter remote_listener |
快速动态监听注册:
|
1
|
SQL> alter system register; |
查看监听服务信息,发现有“REMOTE SERVER”字样，说明此时漏洞存在:
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
E:\oracle\product\10.2.0\db_1\network\ADMIN>lsnrctl services listenerLSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 21-9月 -2016 10:44:18Copyright (c) 1991, 2006, Oracle. All rights reserved.正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))服务摘要..服务 "PLSExtProc" 包含 1 个例程。例程 "PLSExtProc", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:0 已被拒绝:0LOCAL SERVER服务 "orcl" 包含 2 个例程。例程 "orcl", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:0 已被拒绝:0LOCAL SERVER例程 "orcl", 状态 READY, 包含此服务的 2 个处理程序...处理程序:"DEDICATED" 已建立:0 已拒绝:0 状态:readyLOCAL SERVER"DEDICATED" 已建立:0 已拒绝:0 状态:readyREMOTE SERVER(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))服务 "orclXDB" 包含 1 个例程。例程 "orcl", 状态 READY, 包含此服务的 1 个处理程序...处理程序:"D000" 已建立:0 已被拒绝:0 当前: 0 最大: 1002 状态: readyDISPATCHER <machine: INSPUR-IRMS-138, pid: 6728>(ADDRESS=(PROTOCOL=tcp)(HOST=INSPUR-IRMS-138)(PORT=52676))服务 "orcl_XPT" 包含 1 个例程。例程 "orcl", 状态 READY, 包含此服务的 2 个处理程序...处理程序:"DEDICATED" 已建立:0 已拒绝:0 状态:readyLOCAL SERVER"DEDICATED" 已建立:0 已拒绝:0 状态:readyREMOTE SERVER(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))命令执行成功 |
3.2 取消注释COST规则验证监听情况
3.2.1 取消注释COST规则重启监听并快速注册，验证监听服务信息
去掉监听文件末尾行前的“#”号：
|
1
|
SECURE_REGISTER_LISTENER = (TCP) |
重启监听：
|
1
2
|
lsnrctl stop listenerlsnrctl start listener |
快速注册动态监听：
|
1
|
SQL> alter system register; |
验证监听服务信息,按官档描述，正常应该没有“REMOTE SERVER”字样：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
E:\oracle\product\10.2.0\db_1\network\ADMIN>lsnrctl services listenerLSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 21-9月 -2016 11:00:23Copyright (c) 1991, 2006, Oracle. All rights reserved.正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))服务摘要..服务 "PLSExtProc" 包含 1 个例程。例程 "PLSExtProc", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:0 已被拒绝:0LOCAL SERVER服务 "orcl" 包含 2 个例程。例程 "orcl", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:1 已被拒绝:0LOCAL SERVER例程 "orcl", 状态 READY, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:0 已拒绝:0 状态:blockedREMOTE SERVER(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))服务 "orclXDB" 包含 1 个例程。例程 "orcl", 状态 READY, 包含此服务的 1 个处理程序...处理程序:"D000" 已建立:0 已被拒绝:0 当前: 0 最大: 1002 状态: readyDISPATCHER <machine: INSPUR-IRMS-138, pid: 6728>(ADDRESS=(PROTOCOL=tcp)(HOST=INSPUR-IRMS-138)(PORT=52676))服务 "orcl_XPT" 包含 1 个例程。例程 "orcl", 状态 READY, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:0 已拒绝:0 状态:blockedREMOTE SERVER(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))命令执行成功 实际发现有“REMOTE SERVER”字样，但是对应的监听都是blocked. |
3.2.2 查看监听日志
cd %ORACLE_HOME%/network/log
listener.log日志文件已经有TNS-01194信息，跟官档一致：
|
1
2
3
4
5
6
7
|
21-9月 -2016 11:00:23 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=Administrator))(COMMAND=services)(ARGUMENTS=64)(SERVICE=listener)(VERSION=169870080)) * services * 021-9月 -2016 11:00:54 * service_register_NSGR * 1194TNS-01194: 监听程序命令未到达安全传输21-9月 -2016 11:01:54 * service_register_NSGR * 1194TNS-01194: 监听程序命令未到达安全传输21-9月 -2016 11:02:54 * service_register_NSGR * 1194TNS-01194: 监听程序命令未到达安全传输 |
3.2.3 还原remote_listener设置
测试完成，还原remote_listener设置
|
1
2
|
alter system set remote_listener='' scope=memory;SQL> alter system set remote_listener='' scope=memory; |
3.2.4 查看监听服务信息
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
E:\oracle\product\10.2.0\db_1\network\ADMIN>lsnrctl services listenerLSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 21-9月 -2016 11:22:17Copyright (c) 1991, 2006, Oracle. All rights reserved.正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))服务摘要..服务 "PLSExtProc" 包含 1 个例程。例程 "PLSExtProc", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:0 已被拒绝:0LOCAL SERVER服务 "orcl" 包含 1 个例程。例程 "orcl", 状态 UNKNOWN, 包含此服务的 1 个处理程序...处理程序:"DEDICATED" 已建立:1 已被拒绝:0LOCAL SERVER命令执行成功 |
4.Reference
•Using Class of Secure Transport (COST) to Restrict Instance Registration (文档 ID 1453883.1)
原文链接：http://www.cnblogs.com/jyzhao/p/5892006.html
