Solution
Recommendations for protecting against this vulnerability can be found at:
My Oracle Support Note 1340831.1 for Oracle Database deployments that use Oracle Real Application Clusters (RAC).
My Oracle Support Note 1453883.1 for Oracle Database deployments that do not use RAC.
目前这里环境不是RAC,参考文档1453883.1:
Using Class of Secure Transport (COST) to Restrict Instance Registration (文档 ID 1453883.1)
找到两种解决方案:
SOLUTION
There are two methods that can be used to protect the listener using COST "SECURE_REGISTER_listener_name =" in stand alone database installations.
1) Restricting registration to the TCP protocol (Requires the fix for BUG:12880299)
- or -
2) Restricting registration to the IPC protocol (The patch for BUG:12880299 is NOT required for the IPC method)
Either method accomplishes the same goal but it is your choice which type to implement subject to the restriction* noted below. Both methods will be discussed.
•The second method (using IPC) cannot be used if the database is a member of an Oracle Data Guard broker configuration.
我这里选择第一种解决方案:
1) Restricting registration to the TCP protocol (Requires the fix for BUG:12880299)。
SQL> show parameter local_listener
NAME TYPE VALUE
------------------------------------ ----------- ---------------------------
local_listener string
SQL> show parameter remote_listener;
NAME TYPE VALUE
------------------------------------ ----------- ---------------------------
remote_listener string
SQL>
2.2 尝试应用解决方案
2.2.1 停止监听
lsnrctl stop listener
2.2.2 修改监听配置文件
Add the COST TCP protocol restriction "SECURE_REGISTER_[listener_name] = (TCP)" to the listener.ora.
Match the COST parameter variable listener_name with the name of the listener you are using in the listener.ora, e.g., If your listener name is "LISTENER_PROD" then use SECURE_REGISTER_LISTENER_PROD = (TCP)
实际修改过程:
切换到监听配置文件所在路径:
cd %ORACLE_HOME%/network/admin
直接修改listener.ora文件,在文件的末尾添加一行:
SECURE_REGISTER_LISTENER = (TCP)
2.2.3 启动监听
启动监听:
lsnrctl start listener
立即注册动态监听:
SQL> alter system register;
2.2.4 设置local_listener
alter system set local_listener='(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST =192.168.1.138)(PORT = 1521)))' scope = both;
show parameter local_listener
2.2.5 查看监听服务信息
lsnrctl services listener
E:\oracle\product\10.2.0\db_1\network\ADMIN>lsnrctl services listener
LSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 21-9月 -2016 10:2
2:02
Copyright (c) 1991, 2006, Oracle. All rights reserved.
正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
服务摘要..
服务 "PLSExtProc" 包含 1 个例程。
例程 "PLSExtProc", 状态 UNKNOWN, 包含此服务的 1 个处理程序...
处理程序:
"DEDICATED" 已建立:0 已被拒绝:0
LOCAL SERVER
服务 "orcl" 包含 1 个例程。
例程 "orcl", 状态 UNKNOWN, 包含此服务的 1 个处理程序...
处理程序:
"DEDICATED" 已建立:3 已被拒绝:0
LOCAL SERVER
命令执行成功
3.验证修补情况
3.1 注释COST规则验证监听情况
3.1.1 注释掉listener.ora文件的COST规则并重启监听
Comment the COST rule in listener.ora and restart the listener.
直接修改listener.ora文件,在之前添加的一行前面加上"#"注释此行。
#SECURE_REGISTER_LISTENER = (TCP)
重启监听:
lsnrctl stop listener
lsnrctl start listener
3.1.2 设置remote_listener后查看监听服务信息
设置remote_listener:
SQL> alter system set remote_listener='(ADDRESS = (PROTOCOL = TCP)(HOST =192.168.1.138)(PORT = 1521))' scope=memory;
SQL> show parameter remote_listener
快速动态监听注册:
SQL> alter system register;
查看监听服务信息,发现有“REMOTE SERVER”字样,说明此时漏洞存在:
E:\oracle\product\10.2.0\db_1\network\ADMIN>lsnrctl services listener
LSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 21-9月 -2016 10:4
4:18
Copyright (c) 1991, 2006, Oracle. All rights reserved.
正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
服务摘要..
服务 "PLSExtProc" 包含 1 个例程。
例程 "PLSExtProc", 状态 UNKNOWN, 包含此服务的 1 个处理程序...
处理程序:
"DEDICATED" 已建立:0 已被拒绝:0
LOCAL SERVER
服务 "orcl" 包含 2 个例程。
例程 "orcl", 状态 UNKNOWN, 包含此服务的 1 个处理程序...
处理程序:
"DEDICATED" 已建立:0 已被拒绝:0
LOCAL SERVER
例程 "orcl", 状态 READY, 包含此服务的 2 个处理程序...
处理程序:
"DEDICATED" 已建立:0 已拒绝:0 状态:ready
LOCAL SERVER
"DEDICATED" 已建立:0 已拒绝:0 状态:ready
REMOTE SERVER
(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
服务 "orclXDB" 包含 1 个例程。
例程 "orcl", 状态 READY, 包含此服务的 1 个处理程序...
处理程序:
"D000" 已建立:0 已被拒绝:0 当前: 0 最大: 1002 状态: ready
DISPATCHER <machine: INSPUR-IRMS-138, pid: 6728>
(ADDRESS=(PROTOCOL=tcp)(HOST=INSPUR-IRMS-138)(PORT=52676))
服务 "orcl_XPT" 包含 1 个例程。
例程 "orcl", 状态 READY, 包含此服务的 2 个处理程序...
处理程序:
"DEDICATED" 已建立:0 已拒绝:0 状态:ready
LOCAL SERVER
"DEDICATED" 已建立:0 已拒绝:0 状态:ready
REMOTE SERVER
(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
命令执行成功