Workaround for Oracle TNS Listener issue released !

Published: 2012-04-30
Last Updated: 2012-05-01 15:31:30 UTC
by Rob VandenBrink (Version: 2)
2 comment(s)

Just a quick update to Johannes's story on the 27th about the Oracle TNS listener vulnerability ( http://isc.sans.edu/diary.html?storyid=13069 )

We received two updates from our readers on this today:
Reader "anothergeek" posted a comment to Johannes's story, noting that Oracle released a workaround today (Apr 30) - find details here ==> http://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html

Shortly after, reader R.P. pointed us to a page that had proof of concept ( with a video no less) ==> http://eromang.zataz.com/2012/04/30/oracle-database-tns-poison-0day-video-demonstration/



So get that maintenance window scheduled folks!  Those patches don't do you any good in your Downloads folder!

From the perspective of someone who does audits and assessments, it's a sad thing to note that in many organizations it's tough to schedule maintenance on a large Oracle server.  So many applications get piled on these that database and operating system patches can be a real challenge to book, because an interruption in service can affect dozens or hundreds of applications.

Sadly this means that database patches are often quarterly or annual events.  Or "fairy tale events" (as in never-never).
 

===============
Rob VandenBrink
Metafore

Keywords: oracle tns listener
2 comment(s)

Comments

Please note that "Oracle Security Alert for CVE-2012-1675" is not a patch, it's just a workaround.
The workarounds listed have been part of the DISA STIG's for some time - I find this 0 day to be slightly alarmest...

Diary Archives