A few days after the last critical patch update Oracle had to post security alert for CVE-2012-1675. The issue also known as “TNS Listener Poison Attack” is affecting any Oracle Database Server. As a personal reference I have summarized the most important information about this topic.

Vulnerability Description

This security alert addresses the security issue CVE-2012-1675, a vulnerability in the TNS listener which has been recently disclosed as “TNS Listener Poison Attack” affecting the Oracle Database Server. This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to impact the confidentiality, integrity and availability of systems that do not have recommended solution applied. The post The history of a -probably- 13 years old Oracle bug: TNS Poison from Joxean Koret is explaining how this vulnerability can be exploited.

Impact

The attack point of this vulnerability is once again the Oracle listener. The impact of this vulnerability differs from the network configuration of the database server and listener. Public accessible listener will suffer a lot from this issue while internal listener a bit less.

• Public accessible Listener e.g. listener is accessible from the internet => extremely critical
• Listener is accessible by the company network e.g. any client can access the listener => very critical
• Network zoning or network segmentation is used. E.g only a limited number of system accessing (application server) can access listener => critical

Bug fix

According to Oracle (see web sources below) there is no security fix for this issue. It probably will not be fixed before Oracle 12c. Until now there are several workarounds to eliminate or minimize the potential security risk.

Workaround

In order to prevent the exploitation of the vulnerability the dynamic registration must be switched of or it must be limited (e.g only local registrations, allow certain IP’s or identified by certificate )

1. Switch off dynamic registration

Switch off dynamic registration by setting dynamic_registration_LISTENER_NAME=off in listener.ora according to DYNAMIC_REGISTRATION_listener_name To switch off the dynamic registration is not an option if you’re using Oracle DataGuard, RAC or the PL/SQL Gateway in connection with APEX.

2. Using Class of Secure Transport on single inctance databases

Oracle recommend to set class of secure transportation to restrict instance registration to the local system. This parameter is available since Oracle 10.2.0.3 and can be implemented according to MOS Note 1453883.1

3. Using Class of Secure Transport in Oracle RAC

For RAC the use of COST is a bit more complex and require to configure SSL/TCPS. This is as well only possible for Oracle 10.2.0.3 and newer. It can be implemented according to MOS Note 1340831.1

4. Limit Network Access

Start using valid node checking to limit access to listener to certain IP addresses.

TCP.VALIDNODE_CHECKING = YES
TCP.INVITED_NODE = (Comma separated list of ALL valid, clients)

5. Limit Network Access on the network

As an alternative limit network access to certain listener on the network layer e.g. network segmentation, firewalls etc.

Strategy

I recommend to install the latest CPU / PSU as well as one of the workaround mentioned above. In it is a good advice to switch of remote registration in general if it is not used e.g for RAC.

What to do when the workaround is not available for the database release e.g 9i databases? From the security point of view I recommend to upgrade the database to the latest supported major release with in a useful time.

Web Sources

Web sources around this topic.

• Oracle Critical Patch Update Advisory – April 2012
• Oracle Security Alert for CVE-2012-1675
• Patch Set Update and Critical Patch Update April 2012 Availability Document [1406574.1]
• Using Class of Secure Transport (COST) to Restrict Instance Registration [1453883.1]
• Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC [1340831.1]
• Oracle Database Standard Edition and Oracle Real Application Clusters (Oracle RAC)
• Workaround statt Patch für die Oracle Datenbank: Oracle gerät aufgrund ungepatchter Sicherheitslücke in die Kritik
• Oracle dichtet am Patchday 88 Lücken ab
• Oracle-Datenbanken anfällig für eingeschleuste Lauscher
• Kritische Sicherheitslücke in Oracle-Datenbank verplappert
• Oracle reagiert (ein bisschen) auf verplapperte Sicherheitslücke
• Oracle ändert Lizenzmodell wegen verplapperter Sicherheitslücke
• US-CERT Vulnerability Note VU#359816
• The history of a -probably- 13 years old Oracle bug: TNS Poison
• Oracle TNS Poison vulnerability is actually a 0day with no patch available
• How To Configure Scan Listeners With A TCPS Port? [1092753.1]