{"id":860,"date":"2012-05-15T14:26:49","date_gmt":"2012-05-15T12:26:49","guid":{"rendered":"http:\/\/www.oradba.ch\/?p=860"},"modified":"2013-10-14T22:33:00","modified_gmt":"2013-10-14T20:33:00","slug":"oracle-tns-poison-vulnerability","status":"publish","type":"post","link":"https:\/\/www.oradba.ch\/wordpress\/2012\/05\/oracle-tns-poison-vulnerability\/","title":{"rendered":"Oracle TNS Poison vulnerability"},"content":{"rendered":"<p>A few days after the last critical patch update Oracle had to post security alert for CVE-2012-1675. The issue also known as &#8220;TNS Listener Poison Attack&#8221; is affecting any Oracle Database Server. As a personal reference I have summarized the most important information about this topic.<\/p>\n<h3>Vulnerability Description<\/h3>\n<p>This security alert addresses the security issue CVE-2012-1675, a vulnerability in the TNS listener which has been recently disclosed as &#8220;TNS Listener Poison Attack&#8221; affecting the Oracle Database Server. This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to impact the confidentiality, integrity and availability of systems that do not have recommended solution applied. The post <a href=\"http:\/\/seclists.org\/fulldisclosure\/2012\/Apr\/204\">The history of a -probably- 13 years old Oracle bug: TNS Poison<\/a> from Joxean Koret is explaining how this vulnerability can be exploited.<\/p>\n<h3>Impact<\/h3>\n<p>The attack point of this vulnerability is once again the Oracle listener. The impact of this vulnerability differs from the network configuration of the database server and listener. Public accessible listener will suffer a lot from this issue while internal listener a bit less.<\/p>\n<ul>\n<li>Public accessible Listener e.g. listener is accessible from the internet  =><em> extremely critical<\/em><\/li>\n<li>Listener is accessible by the company network e.g. any client can access the listener => <em>very critical<\/em><\/li>\n<li>Network zoning or network segmentation is used. E.g only a limited number of system accessing (application server) can access listener => <em>critical<\/em><\/li>\n<\/ul>\n<h3>Bug fix<\/h3>\n<p>According to Oracle (see web sources below) there is no security fix for this issue. It probably will not be fixed before Oracle 12c. Until now there are several workarounds to eliminate or minimize the potential security risk.<\/p>\n<h3>Workaround<\/h3>\n<p>In order to prevent the exploitation of the vulnerability the dynamic registration must be switched of or it must be limited (e.g only local registrations, allow certain IP&#8217;s or identified by certificate )<\/p>\n<ol>\n<li><em>Switch off dynamic registration<\/em><\/li>\n<p>Switch off dynamic registration by setting <em>dynamic_registration_LISTENER_NAME=off<\/em> in listener.ora according to <a href=\"http:\/\/docs.oracle.com\/cd\/E11882_01\/network.112\/e10835\/listener.htm#BGBCEJHE\">DYNAMIC_REGISTRATION_listener_name<\/a> To switch off the dynamic registration is not an option if you&#8217;re using Oracle DataGuard, RAC or the PL\/SQL Gateway in connection with APEX.<\/p>\n<li><em>Using Class of Secure Transport on single inctance databases<\/em><\/li>\n<p>Oracle recommend to set class of secure transportation to restrict instance registration to the local system. This parameter is available since Oracle 10.2.0.3 and can be implemented according to MOS Note <a href=\"https:\/\/support.oracle.com\/CSP\/main\/article?cmd=show&#038;type=NOT&#038;id=1453883.1\">1453883.1<\/a><\/p>\n<li><em>Using Class of Secure Transport in Oracle RAC<\/em><\/li>\n<p>For RAC the use of COST is a bit more complex and require to configure SSL\/TCPS. This is as well only possible for Oracle 10.2.0.3 and newer. It can be implemented according to MOS Note <a href=\"https:\/\/support.oracle.com\/CSP\/main\/article?cmd=show&#038;type=NOT&#038;id=1340831.1\">1340831.1<\/a><\/p>\n<li><em>Limit Network Access<\/em><\/li>\n<p>Start using valid node checking to limit access to listener to certain IP addresses.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"sql\">\r\nTCP.VALIDNODE_CHECKING = YES\r\nTCP.INVITED_NODE = (Comma separated list of ALL valid, clients)\r\n<\/pre>\n<li><em>Limit Network Access on the network<\/em><\/li>\n<p>As an alternative limit network access to certain listener on the network layer e.g. network segmentation, firewalls etc.\n<\/ol>\n<h3>Strategy<\/h3>\n<p>I recommend to install the latest CPU \/ PSU as well as one of the workaround mentioned above. In it is a good advice to switch of remote registration in general if it is not used e.g for RAC. <\/p>\n<p>What to do when the workaround is not available for the database release e.g 9i databases? From the security point of view I recommend to upgrade the database to the latest supported major release with in a useful time.<\/p>\n<h3>Web Sources<\/h3>\n<p>Web sources around this topic.<\/p>\n<ul>\n<li><a href=\"http:\/\/www.oracle.com\/technetwork\/topics\/security\/cpuapr2012-366314.html\">Oracle Critical Patch Update Advisory &#8211; April 2012<\/a><\/li>\n<li><a href=\"http:\/\/www.oracle.com\/technetwork\/topics\/security\/alert-cve-2012-1675-1608180.html\">Oracle Security Alert for CVE-2012-1675<\/a><\/li>\n<li>Patch Set Update and Critical Patch Update April 2012 Availability Document [<a href=\"https:\/\/support.oracle.com\/CSP\/main\/article?cmd=show&#038;type=NOT&#038;id=1406574.1\">1406574.1<\/a>]<\/li>\n<li>Using Class of Secure Transport (COST) to Restrict Instance Registration [<a href=\"https:\/\/support.oracle.com\/CSP\/main\/article?cmd=show&#038;type=NOT&#038;id=1453883.1\">1453883.1<\/a>]<\/li>\n<li>Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC [<a href=\"https:\/\/support.oracle.com\/CSP\/main\/article?cmd=show&#038;type=NOT&#038;id=1340831.1\">1340831.1<\/a>]<\/li>\n<li><a href=\"http:\/\/docs.oracle.com\/cd\/E11882_01\/license.112\/e10594\/editions.htm#DBLIC121\">Oracle Database Standard Edition and Oracle Real Application Clusters (Oracle RAC)<\/a><\/li>\n<li><a href=\"http:\/\/www.doag.org\/home\/aktuelle-news\/article\/workaround-statt-patch-fuer-die-oracle-datenbank-oracle-geraet-aufgrund-ungepatchter-sicherheitslue.html\">Workaround statt Patch f\u00fcr die Oracle Datenbank: Oracle ger\u00e4t aufgrund ungepatchter Sicherheitsl\u00fccke in die Kritik<\/a><\/li>\n<li><a href=\"http:\/\/heise.de\/-1541781\">Oracle dichtet am Patchday 88 L\u00fccken ab<\/a><\/li>\n<li><a href=\"http:\/\/heise.de\/-1563022\">Oracle-Datenbanken anf\u00e4llig f\u00fcr eingeschleuste Lauscher<\/a><\/li>\n<li><a href=\"http:\/\/heise.de\/-1563113\">Kritische Sicherheitsl\u00fccke in Oracle-Datenbank verplappert<\/a><\/li>\n<li><a href=\"http:\/\/heise.de\/-1565358\">Oracle reagiert (ein bisschen) auf verplapperte Sicherheitsl\u00fccke<\/a><\/li>\n<li><a href=\"http:\/\/heise.de\/-1564995\">Oracle \u00e4ndert Lizenzmodell wegen verplapperter Sicherheitsl\u00fccke<\/a><\/li>\n<li><a href=\"http:\/\/www.kb.cert.org\/vuls\/id\/359816\">US-CERT Vulnerability Note VU#359816<\/a><\/li>\n<li><a href=\"http:\/\/seclists.org\/fulldisclosure\/2012\/Apr\/204\">The history of a -probably- 13 years old Oracle bug: TNS Poison<\/a><\/li>\n<li><a href=\"http:\/\/seclists.org\/fulldisclosure\/2012\/Apr\/343\">Oracle TNS Poison vulnerability is actually a 0day with no patch available<\/a><\/li>\n<li>How To Configure Scan Listeners With A TCPS Port? [<a href=\"https:\/\/support.oracle.com\/CSP\/main\/article?cmd=show&#038;type=NOT&#038;id=1092753.1\">1092753.1<\/a>]<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A few days after the last critical patch update Oracle had to post security alert for CVE-2012-1675. The issue also known as &#8220;TNS Listener Poison Attack&#8221; is affecting any Oracle Database Server. As a personal reference I have summarized the most important information about this topic.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[5,11],"tags":[50,138,54,18],"class_list":["post-860","post","type-post","status-publish","format-standard","hentry","category-oracle-database","category-security","tag-advisory","tag-cpu","tag-cve-2012-1675","tag-trivadiscontent"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1aErb-dS","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":788,"url":"https:\/\/www.oradba.ch\/wordpress\/2012\/05\/important-links-around-the-oracle-cpu-psu-april-2012\/","url_meta":{"origin":860,"position":0},"title":"Important links around the Oracle CPU \/ PSU April 2012","author":"Stefan","date":"8. May 2012","format":false,"excerpt":"A few weeks ago oracle officially released the CPU \/ PSU Patches for April 2012. The Critical Patch Updates contains 88 security fixes across all products. But only 6 out of this 88 fixes are for Oracle databases. This post will summarize a bit the information and links around this\u2026","rel":"","context":"In &quot;Critical Patch Update&quot;","block_context":{"text":"Critical Patch Update","link":"https:\/\/www.oradba.ch\/wordpress\/category\/patches\/cpu\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":878,"url":"https:\/\/www.oradba.ch\/wordpress\/2012\/10\/oracle-cpu-psu-pre-release-announcement-october-2012\/","url_meta":{"origin":860,"position":1},"title":"Oracle CPU \/ PSU Pre-Release Announcement October 2012","author":"Stefan","date":"12. October 2012","format":false,"excerpt":"Today Oracle has published the Pre-Release Announcement for the october CPU Patch. This Critical Patch Update contains 109 new security vulnerability fixes for several Oracle products. 5 of these fixes are just for the Oracle Database Server.","rel":"","context":"In &quot;10gR2&quot;","block_context":{"text":"10gR2","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oracle-database\/10gr2\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":11271,"url":"https:\/\/www.oradba.ch\/wordpress\/2022\/08\/easily-mitigate-log4j-vulnerability-in-oracle-unified-directory\/","url_meta":{"origin":860,"position":2},"title":"Easily mitigate log4j vulnerability in Oracle Unified Directory","author":"Stefan","date":"26. August 2022","format":false,"excerpt":"In December 2021, the critical vulnerability in Apache Log4j (CVE-2021-44228) was disclosed. With a CVSS rating of 10 out of 10, this vulnerability was or is extremely critical. Especially since Log4j is used relatively widely. Despite a great effort, many applications could only be corrected with a delay. Thus, it\u2026","rel":"","context":"In &quot;Bundle Patch&quot;","block_context":{"text":"Bundle Patch","link":"https:\/\/www.oradba.ch\/wordpress\/category\/patches\/bp\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/Screenshot-2022-08-25-at-09.00.17.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/Screenshot-2022-08-25-at-09.00.17.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/Screenshot-2022-08-25-at-09.00.17.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/Screenshot-2022-08-25-at-09.00.17.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/Screenshot-2022-08-25-at-09.00.17.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/www.oradba.ch\/wordpress\/wp-content\/uploads\/Screenshot-2022-08-25-at-09.00.17.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":1671,"url":"https:\/\/www.oradba.ch\/wordpress\/2014\/04\/oracle-cpu-psu-pre-release-announcement-april-2014\/","url_meta":{"origin":860,"position":3},"title":"Oracle CPU \/ PSU Pre-Release Announcement April 2014","author":"Stefan","date":"11. April 2014","format":false,"excerpt":"Today Oracle has published the Pre-Release Announcement of the CPU Advisory for April 2014. This Critical Patch Update contains 103 new security vulnerability fixes for several Oracle products. There are only a few days since the publication of the vulnerability CVE-2014-0160 known as \"Heartbleed\". Therefore I assume, that this patch\u2026","rel":"","context":"In &quot;11gR1&quot;","block_context":{"text":"11gR1","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oracle-database\/11gr1\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1887,"url":"https:\/\/www.oradba.ch\/wordpress\/2014\/10\/oracle-software-appliances-and-bash-shellshock\/","url_meta":{"origin":860,"position":4},"title":"Oracle Software Appliances and Bash Shellshock","author":"Stefan","date":"2. October 2014","format":false,"excerpt":"Late September a vulnerability in the bash Shell has been published. The vulnerability also known as shellshock, was classified as extremely critical. Anyway, in the meantime security patch has been released for the different operating systems and bash implementations. A bugfix is also available for Oracle Enterprise Linux, which is\u2026","rel":"","context":"In &quot;AVDF&quot;","block_context":{"text":"AVDF","link":"https:\/\/www.oradba.ch\/wordpress\/category\/audit\/avdf\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1682,"url":"https:\/\/www.oradba.ch\/wordpress\/2014\/04\/update-oracle-and-openssl-heartbleed-vulnerability\/","url_meta":{"origin":860,"position":5},"title":"Update: Oracle and OpenSSL &#8216;Heartbleed&#8217; vulnerability","author":"Stefan","date":"16. April 2014","format":false,"excerpt":"While writing a post about the new Critical Patch Advisory I've discovered, that Oracle made the Information about the OpenSSL Vulnerability publicly available. The information in MOS Note 1645479.1 has been moved to OpenSSL Security Bug - Heartbleed CVE-2014-0160. Until now it looks like that Oracle Databases are not affected\u2026","rel":"","context":"In &quot;11gR2&quot;","block_context":{"text":"11gR2","link":"https:\/\/www.oradba.ch\/wordpress\/category\/oracle-database\/11gr2\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts\/860","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/comments?post=860"}],"version-history":[{"count":3,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts\/860\/revisions"}],"predecessor-version":[{"id":1510,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/posts\/860\/revisions\/1510"}],"wp:attachment":[{"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/media?parent=860"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/categories?post=860"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.oradba.ch\/wordpress\/wp-json\/wp\/v2\/tags?post=860"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}