【Oralce漏洞与安全】AHF的Log4j漏洞修复

2021年12月10日，Oracle发布了Security Alert CVE-2021-44228，以回应2.15版本之前一个影响Apache Log4j的新漏洞的披露。  

 Oracle 19c安装时包括了AHF，19.12中AHF使用的log4j

根据mos建议，需要下载Patch 30166242

[root@dbsrv1 opt]# find ./ -name log4j*
./oracle.ahf/common/jlib/log4j-core-2.13.3.jar
./oracle.ahf/common/jlib/log4j-api-2.13.3.jar

打补丁后AHF中的log4j版本为2.17.0

[root@odbsrv1 opt]# find ./ -name log4j*
./oracle.ahf/common/jlib/log4j-core-2.17.0.jar
./oracle.ahf/common/jlib/log4j-api-2.17.0.jar
[root@dbsrv1 opt]# 

1、 下载补丁Patch 30166242，校验检测后传入服务器，如果单位有安全要求，请先进行补丁介质的杀毒和登记，确保补丁不会对信息系统产生安全影响。

2、 补丁应用，该补丁应用其实是对AHF的升级。使用root用户进行升级操作

[root@dbsrv1 AHF]# ./ahf_setup

AHF Installer for Platform Linux Architecture x86_64

AHF Installation Log : /tmp/ahf_install_214000_14448_2021_12_30-13_27_08.log

Starting Autonomous Health Framework (AHF) Installation

AHF Version: 21.4.0 Build Date: 202112200745

AHF is already installed at /opt/oracle.ahf

Installed AHF Version: 21.2.4 Build Date: 202109222135

Do you want to upgrade AHF [Y]|N : Y

AHF will also be installed/upgraded on these Cluster Nodes :

1. dbsrv2

The AHF Location and AHF Data Directory must exist on the above nodes

AHF Location : /opt/oracle.ahf

AHF Data Directory : /u01/app/grid/oracle.ahf/data

Do you want to install/upgrade AHF on Cluster Nodes ? [Y]|N : Y

Upgrading /opt/oracle.ahf

Shutting down AHF Services

Stopped OSWatcher

Nothing to do !

Shutting down TFA

Removed symlink /etc/systemd/system/multi-user.target.wants/oracle-tfa.service.

Removed symlink /etc/systemd/system/graphical.target.wants/oracle-tfa.service.

Successfully shutdown TFA..

Starting AHF Services

Starting TFA..

Created symlink from /etc/systemd/system/multi-user.target.wants/oracle-tfa.service to /etc/systemd/system/oracle-tfa.service.

Created symlink from /etc/systemd/system/graphical.target.wants/oracle-tfa.service to /etc/systemd/system/oracle-tfa.service.

Waiting up to 100 seconds for TFA to be started..

. . . . .

Successfully started TFA Process..

. . . . .

TFA Started and listening for commands

No new directories were added to TFA

Directory /u01/app/grid/crsdata/dbsrv1/trace/chad was already added to TFA Directories.





INFO: Starting orachk scheduler in background. Details for the process can be found at /u01/app/grid/oracle.ahf/data/dbsrv1/diag/orachk/compliance_start_301221_132959.log





AHF upgrade completed on dbsrv1

节点1的AHF升级成功。继续进行节点2的升级

Upgrading AHF on Remote Nodes :

AHF will be installed on dbsrv2, Please wait.

AHF will prompt twice to install/upgrade per Remote Node. So total 2 prompts

Do you want to continue Y|[N] : Y

AHF will continue with Upgrading on remote nodes

Upgrading AHF on dbsrv2 :

[dbsrv2] Copying AHF Installer

输入节点2的root用户密码

root@dbsrv2's password:

[dbsrv2] Running AHF Installer

root@dbsrv2's password:

Do you want AHF to store your My Oracle Support Credentials for Automatic Upload ? Y|[N] :N

AHF is successfully upgraded to latest version



.--------------------------------------------------------------.

| Host | TFA Version | TFA Build ID | Upgrade Status |

+--------+-------------+----------------------+----------------+

| dbsrv1 | 21.4.0.0.0 | 21400020211220074549 | UPGRADED |

| dbsrv2 | 21.4.0.0.0 | 21400020211220074549 | UPGRADED |

'--------+-------------+----------------------+----------------'



Moving /tmp/ahf_install_214000_14448_2021_12_30-13_27_08.log to /u01/app/grid/oracle.ahf/data/dbsrv1/diag/ahf/

3、 补丁应用验证

检查tfa状态

[root@dbsrv1 data]# tfactl

tfactl> toolstatus



Running command tfactltoolstatus on dbsrv2 ...



.------------------------------------------------------------------.

| TOOLS STATUS - HOST : dbsrv2 |

+----------------------+--------------+--------------+-------------+

| Tool Type | Tool | Version | Status |

+----------------------+--------------+--------------+-------------+

| AHF Utilities | alertsummary | 21.4.0 | DEPLOYED |

| | calog | 21.4.0 | DEPLOYED |

| | dbglevel | 21.4.0 | DEPLOYED |

| | grep | 21.4.0 | DEPLOYED |

| | history | 21.4.0 | DEPLOYED |

| | ls | 21.4.0 | DEPLOYED |

| | managelogs | 21.4.0 | DEPLOYED |

| | menu | 21.4.0 | DEPLOYED |

| | orachk | 21.4.0 | DEPLOYED |

| | param | 21.4.0 | DEPLOYED |

| | ps | 21.4.0 | DEPLOYED |

| | pstack | 21.4.0 | DEPLOYED |

| | summary | 21.4.0 | DEPLOYED |

| | tail | 21.4.0 | DEPLOYED |

| | triage | 21.4.0 | DEPLOYED |

| | vi | 21.4.0 | DEPLOYED |

+----------------------+--------------+--------------+-------------+

| Development Tools | oratop | 14.1.2 | DEPLOYED |

+----------------------+--------------+--------------+-------------+

| Support Tools Bundle | darda | 2.10.0.R6036 | DEPLOYED |

| | oswbb | 8.3.2 | RUNNING |

| | prw | 12.1.13.11.4 | NOT RUNNING |

'----------------------+--------------+--------------+-------------'



Note :-

DEPLOYED : Installed and Available - To be configured or run interactively.

NOT RUNNING : Configured and Available - Currently turned off interactively.

RUNNING : Configured and Available.





.------------------------------------------------------------------.

| TOOLS STATUS - HOST : dbsrv1 |

+----------------------+--------------+--------------+-------------+

| Tool Type | Tool | Version | Status |

+----------------------+--------------+--------------+-------------+

| AHF Utilities | alertsummary | 21.4.0 | DEPLOYED |

| | calog | 21.4.0 | DEPLOYED |

| | dbglevel | 21.4.0 | DEPLOYED |

| | grep | 21.4.0 | DEPLOYED |

| | history | 21.4.0 | DEPLOYED |

| | ls | 21.4.0 | DEPLOYED |

| | managelogs | 21.4.0 | DEPLOYED |

| | menu | 21.4.0 | DEPLOYED |

| | orachk | 21.4.0 | DEPLOYED |

| | param | 21.4.0 | DEPLOYED |

| | ps | 21.4.0 | DEPLOYED |

| | pstack | 21.4.0 | DEPLOYED |

| | summary | 21.4.0 | DEPLOYED |

| | tail | 21.4.0 | DEPLOYED |

| | triage | 21.4.0 | DEPLOYED |

| | vi | 21.4.0 | DEPLOYED |

+----------------------+--------------+--------------+-------------+

| Development Tools | oratop | 14.1.2 | DEPLOYED |

+----------------------+--------------+--------------+-------------+

| Support Tools Bundle | darda | 2.10.0.R6036 | DEPLOYED |

| | oswbb | 8.3.2 | RUNNING |

| | prw | 12.1.13.11.4 | NOT RUNNING |

'----------------------+--------------+--------------+-------------'



Note :-

DEPLOYED : Installed and Available - To be configured or run interactively.

NOT RUNNING : Configured and Available - Currently turned off interactively.

RUNNING : Configured and Available.

tfactl>

检查oracle-tfa.service服务

[root@dbsrv1 data]# systemctl status oracle-tfa.service

● oracle-tfa.service - Oracle Trace File Analyzer

Loaded: loaded (/etc/systemd/system/oracle-tfa.service; enabled; vendor preset: disabled)

Active: active (running) since Thu 2021-12-30 13:29:41 CST; 6min ago

Main PID: 24071 (init.tfa)

CGroup: /system.slice/oracle-tfa.service

├─24071 /bin/sh /etc/init.d/init.tfa run >/dev/null 2>&1 </dev/null

├─24473 /opt/oracle.ahf/jre/bin/java -server -Xms256m -Xmx512m -Djava.awt.headless=true -Ddisable.checkForUpdate=true -XX:HeapDumpPath=/u01/app/grid/oracle....

├─24607 /opt/oracle.ahf/jre/bin/java -server -Xms64m -Xmx128m -XX:HeapDumpPath=/u01/app/grid/oracle.ahf/data/dbsrv1/diag/tfa -DtfaHome=/opt/oracle.ahf/tfa -...

└─51353 /bin/sleep 30



Dec 30 13:34:51 dbsrv1 su[45004]: (to oracle) root on none

Dec 30 13:34:51 dbsrv1 su[45014]: (to oracle) root on none

Dec 30 13:34:51 dbsrv1 su[45023]: (to oracle) root on none

Dec 30 13:34:52 dbsrv1 su[45242]: (to grid) root on none

Dec 30 13:34:52 dbsrv1 su[45251]: (to grid) root on none

Dec 30 13:34:52 dbsrv1 su[45259]: (to oracle) root on none

Dec 30 13:34:52 dbsrv1 su[45266]: (to oracle) root on none

Dec 30 13:34:53 dbsrv1 su[45275]: (to oracle) root on none

Dec 30 13:34:54 dbsrv1 su[45660]: (to grid) root on none

Dec 30 13:34:55 dbsrv1 su[45813]: (to oracle) root on none

-end-