Oracle11.2.0.4.0版本CVE-2012-1675 解决方法

适用版本

本方法仅适用于11.2.0.1.0以及更高版本。

安装系统

CentOS7.5

漏洞标识

CVE-2012-1675

问题描述

官网给出的解决方案如链接: 官网解决方案链接.但是并不适用11.2.0.1.0。我这里是单机版本。

漏洞解决：

文件下载：
CVE-2012-1675漏洞文件下载.
步骤如下：

Oracle Database 11g Release 11.2.0.1.0
ORACLE NET Patch for Bug# 12880299 for Linux-x86-64 Platforms
(RAC Rolling Installable)
Released: Thu May 31 02:32:54 2012
This document describes how you can install the one-off patch for bug#  12880299 on your Oracle Database 11g Release 11.2.0.1.0
 
(1) Prerequisites 【准备】
--------------------
Before you install or deinstall the patch, ensure that you meet the following requirements:
Note: In case of an Oracle RAC environment, meet these prerequisites on each of the nodes.
1.	Ensure that the Oracle Database on which you are installing the patch or from which you are rolling back the patch is Oracle Database 11g Release 11.2.0.1.0.
2.      Oracle recommends you to use the latest version of OPatch. 
	If you do not have the latest version, then follow the instructions outlined in the My Oracle Support note 224346.1 available at:
	https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=224346.1 
3.	Ensure that you set the ORACLE_HOME environment variable to the Oracle home of the Oracle Database.
4.	Ensure that you set the PATH environment variable to include the location of the unzip executable, and the <ORACLE_HOME>/bin and the <ORACLE_HOME>/OPatch directories present in the Oracle home of the Oracle Database.
5.	Ensure that you verify the Oracle Inventory because OPatch accesses it to install the patches. To verify the inventory, run the following command. If the command displays some errors, then contact Oracle Support and resolve the issue.
        $ opatch lsinventory 
6.	Ensure that you shut down all the services running from the Oracle home.
Note:
	-	For a Non-RAC environment, shut down all the services running from the Oracle home. 
	-	For a RAC environment, shut down all the services (database, ASM, listeners, nodeapps, and CRS daemons) running from the Oracle home of the node you want to patch. After you patch this node, start the services on this node.Repeat this process for each of the other nodes of the Oracle RAC system. OPatch is used on only one node at a time.
(2) Installation 【安装】
-----------------
To install the patch, follow these steps:
Note: In case of an Oracle RAC environment, perform these steps on each of the nodes.
1.	stop all instance and listeners
2.	Maintain a location for storing the contents of the patch ZIP file. In the rest of the document, this location (absolute path) is referred to as <PATCH_TOP_DIR>.
3.	Extract the contents of the patch ZIP file to the location you created in Step (1). To do so, run the following command:
	$ unzip -d <PATCH_TOP_DIR> p12880299_112010_Linux-x86-64.zip
4.	Navigate to the <PATCH_TOP_DIR>/12880299 directory:
	$ cd <PATCH_TOP_DIR>/12880299
5.	Install the patch by running the following command:
	$ opatch apply

	Note:
	When OPatch starts, it validates the patch and ensures that there are no conflicts with the software already installed in the ORACLE_HOME of the Oracle Database. OPatch categorizes conflicts into the following types: 
	-	Conflicts with a patch already applied to the ORACLE_HOME - In this case, stop the patch installation and contact Oracle Support Services.
	-	Conflicts with a patch already applied to the ORACLE_HOME that is a subset of the patch you are trying to apply  - In this case, continue with the patch installation because the new patch contains all the fixes from the existing patch in the ORACLE_HOME. The subset patch will automatically be rolled back prior to the installation of the new patch.
6.	configuration listener.ora
	cd $ORACLE_HOME/network/admin
	vi listener.ora
		SECURE_REGISTER_LISTENER = (TCP)
		VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
7.	Start the services from the Oracle home.

(3) Deinstallation 【描述】
---------------------
To deinstall the patch, follow these steps:
Note: In case of an Oracle RAC environment, perform these steps on each of the nodes.
1.	Navigate to the <PATCH_TOP_DIR>/12880299 directory:
	$ cd <PATCH_TOP_DIR>/12880299
2.	Deinstall the patch by running the following command:
	$ opatch rollback -id 12880299
3.	Start the services from the Oracle home.
(4) Bugs Fixed by This Patch
---------------------------------
The following are the bugs fixed by this patch:
  12880299: RAC: TCP HANDLERS BLOCK IF LISTENER REGISTRATION IS RESTRICTED TO IPC W/COST
--------------------------------------------------------------------------
Copyright 2012, Oracle and/or its affiliates. All rights reserved.
--------------------------------------------------------------------------

提示：

所有创建的文件的权限和所属用户组均属于Oracle,我这里是 dba:ora。

参考【侵删】

Oracle Security Alert for CVE-2012-1675.
Oracle远程投毒漏洞CVE-2012-1675解决方法.
ORACLE TNS Listener远程注册投毒（Poison Attack）漏洞.
Oracle local_listener以及remote_listener参数.

结语

遇到问题可以下方评论留言，如有帮助，高抬贵手。