随着对网络安全的进一步重视，Oracle TNS 监听器远程中毒漏洞(CVE-2012-1675)被列为了高危漏洞，需要进行漏洞修复。
从Oracle 11.2.0.4开始，Oracle 引入了Valid Node Checking For Registration(VNCR)新特性,可以通过配置参数VALID_NODE_CHECKING_REGISTRATION_LISTENER来修复该漏洞。
1. 修复Oracle TNS 监听器远程中毒漏洞
1.1 修改监听文件
vi $ORACLE_HOME/network/admin/listener.ora
# listener.ora Network Configuration File: /u01/app/oracle/product/11.2.0/db_1/network/admin/listener.ora
# Generated by Oracle configuration tools.
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(GLOBAL_DBNAME = ods)
(ORACLE_HOME = /u01/app/oracle/product/11.2.0/db_1)
(SID_NAME = ods)
)
)
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = IP或主机名)(PORT = 1521))
# (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521)) --注释掉，一般不会使用ipc，绝大部分应用使用tcp连接数据库
)
)
ADR_BASE_LISTENER = /u01/app/oracle
# 单实例只需要新增下面这一行就OK
VALID_NODE_CHECKING_REGISTRATION_LISTENER=1
# RAC需要新增下面三行，有多少个LISTENER_SCAN监听就添加几个
VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=ON
REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(添加rac节点的所有public IP，包括主机IP，VIP，SCANIP)
1.2 重新加载监听
lsnrctl reload
lsnrctl reload listener_scan1 # RAC实例还需要执行该命令
2. 验证漏洞修复情况
2.1. 注释VNCR规则验证监听情况
2.1.1. 注释掉listener.ora文件中的VNCR规则
# 单实例
# VALID_NODE_CHECKING_REGISTRATION_LISTENER=1
# RAC
# VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
# VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=ON
# REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(所有的节点的所有public IP)
2.1.2. 并重新reload监听
lsnrctl reload
lsnrctl reload listener_scan1 # RAC实例还需要执行该命令
2.1.3. 在其他数据库上设置remote_listener
SQL> show parameter remote_listener
SQL> alter system set remote_listener='(ADDRESS = (PROTOCOL = TCP)(HOST =ip)(PORT = 1521))' scope=memory;
SQL> show parameter remote_listener
SQL> alter system register;
2.1.4. 查看监听服务信息
查看监听服务信息中是否有“REMOTE SERVER”字样，该字样就是有该漏洞信息的标志:
$ lsnrctl services listener
LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 04-SEP-2019 17:16:55
Copyright (c) 1991, 2013, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521)))
Services Summary...
Service "TESTDB" has 1 instance(s).
Instance "TESTDB", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:0 refused:0 state:blocked
REMOTE SERVER
(ADDRESS=(PROTOCOL=TCP)(HOST=localhost.localdomain)(PORT=1521))
Service "ods" has 2 instance(s).
Instance "ods", status UNKNOWN, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:0 refused:0
LOCAL SERVER
Instance "ods", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:2 refused:0 state:ready
LOCAL SERVER
Service "odsXDB" has 1 instance(s).
Instance "ods", status READY, has 1 handler(s) for this service...
Handler(s):
"D000" established:0 refused:0 current:0 max:1022 state:ready
DISPATCHER <machine: localhost, pid: 18481>
(ADDRESS=(PROTOCOL=tcp)(HOST=localhost)(PORT=29037))
The command completed successfully
2.1.5. 查看监听日志
04-SEP-2019 17:16:55 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=ip)(USER=oracle))(COMMAND=services)(ARGUMENTS=64)(SERVICE=listener)(VERSION=186647552)) * services * 0
Wed Sep 04 17:17:21 2019
04-SEP-2019 17:17:21 * service_update * testdb * 0
Wed Sep 04 17:17:51 2019
04-SEP-2019 17:17:51 * service_update * testdb * 0
04-SEP-2019 17:17:54 * service_update * testdb * 0
04-SEP-2019 17:17:57 * service_update * testdb * 0
Wed Sep 04 17:18:21 2019
以上信息说明有远程注册的的testdb。
2.2. 生效VNCR规则验证监听情况
2.2.1. 生效VNCR规则
# 单实例
VALID_NODE_CHECKING_REGISTRATION_LISTENER=1
# RAC
VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=ON
REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(所有的节点的所有public IP)
2.2.2. 重新加载监听
lsnrctl reload
lsnrctl reload listener_scan1 # RAC实例还需要执行该命令
2.2.3. 在另一台数据库操作
执行快速动态监听注册命令，因之前已经设置了remote server这里不需要在重新设置了，只需要执行alter system register命令即可。
SQL> alter system register;
2.2.4. 查看监听服务信息
通过查看下面的监听服务信息,已经没有“REMOTE SERVER”字样，说明此时漏洞已修复:
$ lsnrctl services listener
LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 04-SEP-2019 17:26:12
Copyright (c) 1991, 2013, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost(PORT=1521)))
Services Summary...
Service "ods" has 2 instance(s).
Instance "ods", status UNKNOWN, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:0 refused:0
LOCAL SERVER
Instance "ods", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:3 refused:0 state:ready
LOCAL SERVER
Service "odsXDB" has 1 instance(s).
Instance "ods", status READY, has 1 handler(s) for this service...
Handler(s):
"D000" established:0 refused:0 current:0 max:1022 state:ready
DISPATCHER <machine: xxptods, pid: 18481>
(ADDRESS=(PROTOCOL=tcp)(HOST=localhost)(PORT=29037))
The command completed successfully
2.2.5. 查看监听日志
在下面的监听日志中可以看到拒绝了远程监听注册服务
Wed Sep 04 17:25:15 2019
Listener(VNCR option 1) rejected Registration request from destination 10.0.100.7
04-SEP-2019 17:25:15 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
3. 补充说明
3.1. VALID_NODE_CHECKING_REGISTRATION_listener_name
listener_name： 为监听的名字
参数取值：
OFF/0 表示禁用VNCR，此功能不会对注册过来的service进行check
ON/1/LOCAL 表示启用VNCR,默认只允许本机的所有IP的服务注册到本监听,可通过REGISTRATION_INVITED_NODES参数添加其他有必要的服务器
SUBNET/2 表示指定子网内的服务器可以注册过来
3.2. REGISTRATION_INVITED_NODES_listener-name
该参数控制允许链接过来的节点，可以通过IP地址/主机名/网段来指定
For example:REGISTRATION_INVITED_NODES_Listener=(net-vm1, 127.98.45.209, 127.42.5.*)
Note: that when an INVITED list is set, it will automatically include the machine’s local IP in the list. There is no need to include it.
3.3. 11.2.0.4和12c区别之处
在12.1 RAC数据库上，listener的参数VALID_NODE_CHECKING_REGISTRATION_listener_name 默认设置为 SUBNET / 2，即子网中的所有计算机都允许注册.所以12c默认不能解决CVE-2012-1675漏洞
4. 参考文档
Valid Node Checking For Registration (VNCR) (Doc ID 1600630.1)
How to Enable VNCR on RAC Database to Register only Local Instances (Doc ID 1914282.1)
