Oracle TNS Poison vulnerability监听远程注册投毒漏洞

傷城~ 2023-10-19 08:13 199阅读 0赞

## Oracle TNS Poison vulnerability ##

A few days after the last critical patch update Oracle had to post security alert for CVE-2012-1675. The issue also known as “TNS Listener Poison Attack” is affecting any Oracle Database Server. As a personal reference I have summarized the most important information about this topic.

#### Vulnerability Description ####

This security alert addresses the security issue CVE-2012-1675, a vulnerability in the TNS listener which has been recently disclosed as “TNS Listener Poison Attack” affecting the Oracle Database Server. This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to impact the confidentiality, integrity and availability of systems that do not have recommended solution applied. The post [The history of a -probably- 13 years old Oracle bug: TNS Poison][The history of a -probably- 13 years old Oracle bug_ TNS Poison] from Joxean Koret is explaining how this vulnerability can be exploited.

#### Impact ####

The attack point of this vulnerability is once again the Oracle listener. The impact of this vulnerability differs from the network configuration of the database server and listener. Public accessible listener will suffer a lot from this issue while internal listener a bit less.

*  Public accessible Listener e.g. listener is accessible from the internet => *extremely critical*
 *  Listener is accessible by the company network e.g. any client can access the listener => *very critical*
 *  Network zoning or network segmentation is used. E.g only a limited number of system accessing (application server) can access listener => *critical*

#### Bug fix ####

According to Oracle (see web sources below) there is no security fix for this issue. It probably will not be fixed before Oracle 12c. Until now there are several workarounds to eliminate or minimize the potential security risk.

#### Workaround ####

In order to prevent the exploitation of the vulnerability the dynamic registration must be switched of or it must be limited (e.g only local registrations, allow certain IP’s or identified by certificate )

1.  *Switch off dynamic registration:*
    
    switch off dynamic registration by setting *dynamic\_registration\_LISTENER\_NAME=off* in listener.ora according to[DYNAMIC\_REGISTRATION\_listener\_name][DYNAMIC_REGISTRATION_listener_name] To switch off the dynamic registration is not an option if you're using Oracle DataGuard, RAC or the PL/SQL Gateway in connection with APEX.
2.  *Using Class of Secure Transport on single inctance databases*
    
    Oracle recommend to set class of secure transportation to restrict instance registration to the local system. This parameter is available since Oracle 10.2.0.3 and can be implemented according to MOS Note [1453883.1][]
3.  *Using Class of Secure Transport in Oracle RAC*
    
    For RAC the use of COST is a bit more complex and require to configure SSL/TCPS. This is as well only possible for Oracle 10.2.0.3 and newer. It can be implemented according to MOS Note [1340831.1][]
4.  *Limit Network Access*
    
    Start using valid node checking to limit access to listener to certain IP addresses.
    
    TCP.VALIDNODE\_CHECKING = YES  
    TCP.INVITED\_NODE = (Comma separated list OF ALL valid, clients)
5.  *Limit Network Access on the network*
    
    As an alternative limit network access to certain listener on the network layer e.g. network segmentation, firewalls etc.

#### Strategy ####

I recommend to install the latest CPU / PSU as well as one of the workaround mentioned above. In it is a good advice to switch of remote registration in general if it is not used e.g for RAC.

What to do when the workaround is not available for the database release e.g 9i databases? From the security point of view I recommend to upgrade the database to the latest supported major release with in a useful time.

#### Web Sources ####

Web sources around this topic.

*  [Oracle Critical Patch Update Advisory – April 2012][Oracle Critical Patch Update Advisory _ April 2012]
 *  [Oracle Security Alert for CVE-2012-1675][]
 *  Patch Set Update and Critical Patch Update April 2012 Availability Document \[[1406574.1][]\]
 *  Using Class of Secure Transport (COST) to Restrict Instance Registration \[[1453883.1][]\]
 *  Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC \[[1340831.1][]\]
 *  [Oracle Database Standard Edition and Oracle Real Application Clusters (Oracle RAC)][Oracle Database Standard Edition and Oracle Real Application Clusters _Oracle RAC]
 *  [Workaround statt Patch für die Oracle Datenbank: Oracle gerät aufgrund ungepatchter Sicherheitslücke in die Kritik][Workaround statt Patch f_r die Oracle Datenbank_ Oracle ger_t aufgrund ungepatchter Sicherheitsl_cke in die Kritik]
 *  [Oracle dichtet am Patchday 88 Lücken ab][Oracle dichtet am Patchday 88 L_cken ab]
 *  [Oracle-Datenbanken anfällig für eingeschleuste Lauscher][Oracle-Datenbanken anf_llig f_r eingeschleuste Lauscher]
 *  [Kritische Sicherheitslücke in Oracle-Datenbank verplappert][Kritische Sicherheitsl_cke in Oracle-Datenbank verplappert]
 *  [Oracle reagiert (ein bisschen) auf verplapperte Sicherheitslücke][Oracle reagiert _ein bisschen_ auf verplapperte Sicherheitsl_cke]
 *  [Oracle ändert Lizenzmodell wegen verplapperter Sicherheitslücke][Oracle _ndert Lizenzmodell wegen verplapperter Sicherheitsl_cke]
 *  [US-CERT Vulnerability Note VU\#359816][US-CERT Vulnerability Note VU_359816]
 *  [The history of a -probably- 13 years old Oracle bug: TNS Poison][The history of a -probably- 13 years old Oracle bug_ TNS Poison]
 *  [Oracle TNS Poison vulnerability is actually a 0day with no patch available][]
 *  How To Configure Scan Listeners With A TCPS Port? \[[1092753.1][]\]

[The history of a -probably- 13 years old Oracle bug_ TNS Poison]: http://seclists.org/fulldisclosure/2012/Apr/204
[DYNAMIC_REGISTRATION_listener_name]: http://docs.oracle.com/cd/E11882_01/network.112/e10835/listener.htm#BGBCEJHE
[1453883.1]: https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1453883.1
[1340831.1]: https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1340831.1
[Oracle Critical Patch Update Advisory _ April 2012]: http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
[Oracle Security Alert for CVE-2012-1675]: http://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html
[1406574.1]: https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1406574.1
[Oracle Database Standard Edition and Oracle Real Application Clusters _Oracle RAC]: http://docs.oracle.com/cd/E11882_01/license.112/e10594/editions.htm#DBLIC121
[Workaround statt Patch f_r die Oracle Datenbank_ Oracle ger_t aufgrund ungepatchter Sicherheitsl_cke in die Kritik]: http://www.doag.org/home/aktuelle-news/article/workaround-statt-patch-fuer-die-oracle-datenbank-oracle-geraet-aufgrund-ungepatchter-sicherheitslue.html
[Oracle dichtet am Patchday 88 L_cken ab]: http://heise.de/-1541781
[Oracle-Datenbanken anf_llig f_r eingeschleuste Lauscher]: http://heise.de/-1563022
[Kritische Sicherheitsl_cke in Oracle-Datenbank verplappert]: http://heise.de/-1563113
[Oracle reagiert _ein bisschen_ auf verplapperte Sicherheitsl_cke]: http://heise.de/-1565358
[Oracle _ndert Lizenzmodell wegen verplapperter Sicherheitsl_cke]: http://heise.de/-1564995
[US-CERT Vulnerability Note VU_359816]: http://www.kb.cert.org/vuls/id/359816
[Oracle TNS Poison vulnerability is actually a 0day with no patch available]: http://seclists.org/fulldisclosure/2012/Apr/343
[1092753.1]: https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1092753.1