Oracle databases vulnerable to injected listeners

Hi,
Please read it and input your valuable comments. Your opinion(s)/suggestion(s) is very important.
http://www.h-online.com/security/news/item/Oracle-databases-vulnerable-to-injected-listeners-1563150.html
Thanks a lot.
Regards.

Oracle TNS Poison vulnerability

Similar Messages

Hi, I don't know how to find a specific security patch to apply to my Oracle database version to fix a vulnerability

Hi, I don't know how to find a specific security patch to apply to my Oracle database version 11.2.0.2.0 (on windows server 2003 32 bits) to fix the following vulnerability:
Risk: High
Application: oracle_tnslsnr
Port: 1521
Protocol: tcp
Synopsis:
It is possible to register with a remote Oracle TNS listener.
Description:
The remote Oracle TNS listener allows service registration from a remote host. An attacker can exploit this issue to divert data from a
legitimate database server or client to an attacker-specified system.
Successful exploits will allow the attacker to manipulate database instances, potentially facilitating man-in-the-middle, sessionhijacking,
or denial of service attacks on a legitimate database server.
Solution:
Apply the work-around in Oracle's advisory.
Thank you for your help

2835604 wrote:
Hi, I don't know how to find a specific security patch to apply to my Oracle database version 11.2.0.2.0 (on windows server 2003 32 bits) to fix the following vulnerability:
Risk: High
Application: oracle_tnslsnr
Port: 1521
Protocol: tcp
Synopsis:
It is possible to register with a remote Oracle TNS listener.
Description:
The remote Oracle TNS listener allows service registration from a remote host. An attacker can exploit this issue to divert data from a
legitimate database server or client to an attacker-specified system.
Successful exploits will allow the attacker to manipulate database instances, potentially facilitating man-in-the-middle, sessionhijacking,
or denial of service attacks on a legitimate database server.
Solution:
Apply the work-around in Oracle's advisory.
Thank you for your help
that sounds like the "tns poison" vulnerability. CVE 2012-1675 - Oracle Security Alert CVE-2012-1675
See MOS note 134083.1 and 1453883.1

Oracle Database Control Component Unspecified Vulnerability (CVE-2007-5530)

Hi experts,
Recently we are getting some vulnerabilities on one of our server. But we are unable to download and find patches which were mentioned in that.
Ex:
Oracle Database Control Component Unspecified Vulnerability (CVE-2007-5530)
Oracle Database OLAP Component Unspecified Vulnerability (CVE-2008-3997)
The entire report is showing these patch names, can you please suggest where i have to download these patches. I searched these in metalink but didn't found anything.
*These are coming on one of our SAP appliation. so i am requesting suggetion here.
Regards
Nick Loy

Nick,
Check below links.
http://secunia.com/advisories/cve_reference/CVE-2008-3997/
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html
http://secunia.com/advisories/cve_reference/CVE-2007-5530/
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2007.html
http://www.juniper.net/security/auto/vulnerabilities/vuln26039.html..
Hope this helps you.
Thanks,
Sushil

Using Coherence and Oracle Database as the CacheStore

We are working on implementing a solution using Coherence and Oracle Database as the CacheStore. We initially implemented the Cache as a distributed-scheme which in turn uses the backing-map-scheme. We are trying to introduce transaction management and I used a scheme-ref in a transactional-scheme to point to an already existing distributed-scheme. However when I bring up the server, my custom coherence-cache-config.xml file is not recognized and Coherence comes up with the default setting. Given below is the snippet of my configuration file.
1) I would like to understand why the below configuration doesn’t work and am I doing it the right way? If not, what is the correct way of doing it?
2) There are a multiple transaction management options given in the documentation. Which are the ones that will work with a distributed-scheme and read-write-backing-map-scheme?
3) If transactional-schemes cannot work with distributed-scheme, what is the best way to have a distributed cache with a oracle database as a cache store?
<caching-scheme-mapping>
<cache-mapping>
<cache-name>id<cache-name>
<scheme-name>example-transactional<scheme-name>
</cache-mapping>
</caching-scheme-mapping>
<caching-schemes>
<transactional-scheme>
<scheme-name>example-transactional</scheme-name>
<scheme-ref>distributedcustomcache</scheme-ref>
<thread-count>10</thread-count>
</transactional-scheme>
<distributed-scheme>
<scheme-name>distributedcustomcache</scheme-name>
<service-name>DistributedCache</service-name>
<backing-map-scheme>
<read-write-backing-map-scheme>
<internal-cache-scheme>
<local-scheme>

<scheme-name>inMemory</scheme-name>
</local-scheme>
</internal-cache-scheme>
<cachestore-scheme>
<class-scheme>
<class-name>spring-bean:coherenceCacheStore</class-name>
<init-params>
<init-param>
<param-name>setEntityName</param-name>
<param-value>{cache-name}</param-value>
</init-param>
</init-params>
</class-scheme>
</cachestore-scheme>

</read-write-backing-map-scheme>
</backing-map-scheme>
<autostart>true</autostart>
</distributed-scheme>

Hi,
If you look at the documentation for transactional-scheme here: http://docs.oracle.com/cd/E24290_01/coh.371/e22837/appendix_cacheconfig.htm#BHCIABHA
you will see that it says The transactional-scheme element defines a transactional cache, which is a specialized distributed cache. That means that a transactional-scheme is already a distributed-scheme.
You will see from the same documentation above that there is no way in a transactional-scheme to configure things like cache-stores or listeners or even the backing-map-scheme as these are not supported on a transactional-scheme - so you cannot use a cache store.
Personally I would not use transactional-scheme unless you have some really big reason to do so - the restrictions far outweigh any perceived advantage of having a transaction. There are better ways to build applications so they do not require transactions, that is what we have been doing for years with Coherence so far, and there is no real reason to change that.
JK

Can Jdeveloper Be Used For Non-Oracle Databases

I have been trying to evaluate Jdeveloper 9i and Jbuilder 7 Enterprise for Swing database development. I am particularly interested in the productivity enhancements such as BC4J and Jclient. The underlying database might be Oracle, SapDb (excellent, easy to use, and free), SQLServer, etc.
I evaluated Jbuilder Enterprise tools and it worked flawlessly with SapDb. This emphasized using their DataExpress and DbSwing components which provide many useful capabilities similar to BC4j and Jclient. It also involved using their DBPilot tool which allows browsing similar to that provided via a Jdeveloper connection.
I tried to use Jdeveloper for the same SapDB and it is essentially non-functional. I followed the instructions for using a non-default driver and tried to define a connection. It behaved inconsistently: often saying no suitable driver can be found and yet when you edit the connection and test without making any changes, it works. If you try to establish a BC4J definition, it is very inconsistent and fails to recognize important details as foreign keys. Even if you define a ViewLink manually, it still does not work properly if you attempt to define a Master-Detail Jclient form. As I have stated, all these types of capabilities worked flawlessly in their Jbuilder equivalent. Furthermore, I really like the fact that Jbuilder gives many of BC4Js benefits without needing a BC4J J2EE container.
Has anyone had real success using Jdeveloper's advanced features to develop for non-Oracle databases and if so, how did you get around these types of problems?

Hi,
generally, SCAN can be used for 10g databases and you discovered the first half: for 10g databases you will have to modify the REMOTE_LISTENER entry for each 10g database instance to point to the SCAN listeners (as opposed to pointing to the remote local listeners, which is the default in 10g). You could even have the databases registers themselves with SCAN and the remote listeners, if you wanted to... It's more or less a matter of configuration. But for simplification reasons, I will stick to the case where you have your 10g databases register with the SCAN listeners only.
Now the other half is the client and the client configuration. An 11g Rel. 2 client configured for RAC would have a TNSNAMES entry that has only one address line for the RAC databases. The host entry in this one address line should point to the SCAN (the SCAN name is ideally resolved in DNS). A 10g client configured for RAC would have as many address lines in the TNSNAMES as you have nodes in the cluster.
The 10g client SCAN configuration would then be in the middle so to speak: You would have 3 address lines in your TNSNAMES, in which each host entry would resolve to one SCAN address (I assume you will use the recommended default of 3 SCAN IPs). If you choose, you can have a name resolution for each of your SCAN IPs, but this would not be required. Now, why would you do it this way? Because this configuration will always work and does not make you dependent on certain functionality that your DNS server may or may not offer.
For the remaining questions: SCAN is a DNS entry resolving one name to more than one (typically 3) IP addresses. OID is short for Oracle Internet Directory, which is a complete LDAP server. And you are right that there is no document how to configure 10g clients for SCAN from Oracle yet. However, there is a quite good document on SCAN on otn.oracle.com/rac, but I am sure you are aware of it already.
Hope that helps. Thanks,
Markus

Symantec antivirus Best practice for oracle database on windows server 2003

Hi all,
I have an oracle database server on windows server 2003 platform of version 10.2.0.4. what would be best practice of running symantec antivirus on that server as well as database file exclusions from scanning them.
My server had rebooted unexpectedly for many times. in event log i have id as 6008. what may be cause of it..?

Normally, you don't run a virus scanner on a database server because your database server isn't vulnerable to viruses. It's behind firewalls, people aren't reading mail on it, people aren't plugging thumb drives into it, etc. If you do decide that you need to run a virus scanner on a database server, at least exclude the Oracle data files from the scan. Oracle gets very unhappy if someone else tries to open its data files (or, worse, if someone opens a data file before it gets the chance to acquire exclusive access).
Justin

Problems with connection with Oracle Database (Dreamweaver)

I'm trying to create a connection with a oracle database, with JDBC.
In order to do that, I've downloaded the classes12.zip driver in my machine. This is the driver from Oracle.
I've put this file into directory c:\Program Files\Macromedia\Dreamweaver MX\Configuration\JDBCDrivers.
So, I've gone to Window -> Application -> Databases menu into Dreamweaver MX, clicked in the plus (+) signal and choosed Oracle thin Driver (Oracle).
I've filled thin window with the following values:
Connection name: conn1
Driver: oracle.jdbc.driver.OracleDriver
URL: jdbc:oracle:thin:@machinename:1521:SID
Username: ....
Password: ...
When I click in the Test button into this window, the following success message appears:
Connection was made successfully!
But when I go to Bindings window to build a Recordset, the connection doesn't get the tables, and the following error message appears:
Unable to retrieve tables from this connection, click on 'Define...' button to test this connection.
Does somebody know the answer for this problem?
Thank you.

Don't bother with a loopback adapter unless you are using a laptop that needs Oracle to work whether connected or unconnected to the business network. Much simpler to just arrange for DHCP to assign you a fixed IP address (a lease reservation).
It's the change of IP address which trips Oracle up, not the existence of DHCP. So if you can make sure your IP address will be the same, no matter how you acquire it, that's all you have to do.
Installing a loopback adapter which isn't the primary interface at the point you install Oracle will mean your installation will get very confused as to whether to address things via the 127... address or the "normal" IP address. And yes, at that point, you'll not be able to connect to instances, or run listeners or do all sorts of other things reliably.
If it were me, I'd uninstall the mess you probably now have as far as Oracle goes, install something like VirtualBox (free) or VMware Workstation (costs) and enjoy your Oracle experience inside the confines of a virtual machine whose networking setup you can configure and control to your heart's content, without it screwing up your real machine's ability to connect to your work's network when it needs to.

EM12c Oracle Database Plug-In 12.1.0.7 update now shows 10g listener as down when it's not

EM 12.1.0.4 with Oracle Database Plug-in 12.1.0.7
Monitored database and listener: 10.2.0.4
Our EM12c monitors 12.1,11.2 and 10.2 databases and listeners. All monitored targets are up and running.
I updated Oracle Database Plug-in from 12.1.0.6 to 12.1.0.7 and now the only 10g listener that I have shows as down.
The listener on the server is up and running.
The monitoring configuration is right.
I removed this target and re-added it, but it came back as down.
It's a little disconcerting to have a listener show as down since it's a production box, but nothing I do corrects the problem.
Any insights or suggestions are appreciated.
Sherrie

Hi Sherrie,
In most cases we have this issue due to monitoring configuration , I know you mentioned that you have checked on it but still I would recommend to just re-confirm on below steps
1. Go to
 EM Console -> Targets -> Listener -> Listener Home page -> Target Setup -> Monitoring Configuration
2. Get the details
 Listener Name
 Listener.ora Directory
 Machine Name
 Oracle Home
 TCP Port Numbe
3. Go to the server where this listener is running
 Check to see if the listener is up
 ps -ef | grep tns
4. Next run
 $ORACLE_HOME/bin/lsnrctl status
 From this outpuy verify details in (1)
 Listener Name <======= Alias
 Listener.ora Directory <=== Listener Parameter File ie the directory
 Machine Name <======= HOST=
 Oracle Home<========== This is where tnslsnr is started from
 TCP Port Number <====== PORT=
5. Makes sure that all the details matches in (4) and (2)
If above is fine then I would recommend to go through the troubleshooting steps as per below doc , they are valid for listener status down too and should give a further insight on the root cause of the issue
Troubleshooting the 'Pending' status for a Listener Target in Enterprise Manager 12c Cloud Control (Doc ID 1546576.1)
Regards,
Rahul

Two Oracle databases on one AIX Server - Note working, Pls Help

Dear Friends,
I have installed Two SAP systems with Two Oracle Databases on one AIX machine, The Installation of both the systems went fine without any errors, and also i have been able to login to both the systems seperately. (that means i cant start both the systems at a time, its one at a time)
But the problem is of the Oracle Listener, i am not able to start both the systems with single Oracle Listener processes(tnslistener). I tried all the possible scenarios as mentioned in note 98252 but nothing seems to be of any use so far.
the thing is i can start either one of the SAP Systems, But my objective is to start both the SAP Systems with one listener processes (LISTENER) and one listener port (1527)
Or
you can say i am also ready to keep two different listeners for TWO seperate Oracle databases, I tried doing so as per one of the sap notes in which you have to keep different names of listener and different numbers for listener port for second ORACLE database. I tried doing exactly mentioned in the note but yet unsuccessful...
Now i am completely lost as what is to be done since its critical i want you to immediately look into it and suggest me the appropriate solution so that i can set up both of my DEVELOPMENT and QUALITY system running...
To troubleshoot this if you require anything from my side then please feel free to ask me since our functional consultants have to soon start working on the SAP systems.
Regards
Ayush

The note you specified talk about 2 database instances not 2 databases... (I was starting to wonder how you deploy 2 databases), you can have multiple database instances on a DB. The note also give you detailed explanation of the configuration of listener.ora
Now, if this is the case and you have installed 2 instances (not databases) on the same host and configured the listener according to the note, then you should be able to call R3trans -d from both SID's.. if the R3trans fails please post the contents of trans.log here.
the thing is i can start either one of the SAP Systems, But my objective is to start both the SAP Systems with one listener processes (LISTENER) and one listener port (1527)
Then, the configuration of your listener.ora file must be incorrect.
Regards
Juan

Problem querying an Oracle Database using PHP

Hi there, im rather new to Oracle so pardon my ignorance if this is completely obvious but I am creating a web form that queries an oracle database, firstly is a user form which looks like this.
 
Search for Investments 
<form action="query.php" method="POST"> 
<input type = "text" name = "invest"> 
<input type="submit" value="Search" name="submit" /> 
</form> 
----------------------- 
and the php script which looks like this 
----------------------- 
<?php <
print "<HTML><PRE>"; 
require_once('connect.php'); 
select_data($conn); 
$invest = $_POST['invest']; 
echo "Returning results related to $invest"; 
function select_data($conn) 
{ $stmt = ociparse($conn,"select * from investmentbase where INVTYPE='$invest'"); 
ociexecute($stmt,OCI_DEFAULT); 
echo "<table border = 1 class=results>"; 
echo "<tr>"; 
echo "<td>Reference Number</td>"; 
echo "<td>User ID</td>"; 
echo "<td>Investment Type</td>"; 
echo "<td>Investment Description</td>"; 
echo "<td>Amount Required</td>"; 
echo "<td>Due Date<td>"; 
echo "</tr>"; 
while (ocifetch($stmt)){ 
echo "<tr>"; 
echo "<td>"; 
echo ociresult($stmt,"INVREF")." "; 
echo "</td>"; 
echo "<td>"; 
echo ociresult($stmt,"USERID")." "; 
echo "</td>"; 
echo "<td>"; 
echo ociresult($stmt,"INVTYPE")." "; 
echo "</td>"; 
echo "<td>"; 
echo ociresult($stmt,"INVDESCRIPTION")." "; 
echo "</td>"; 
echo "<td>"; 
echo ociresult($stmt,"AMOUNTREQUIRED")." "; 
echo "</td>"; 
echo "<td>"; 
echo ociresult($stmt,"REQUIREDATE"); 
echo "</td>"; 
echo "</tr>"; 
} 
echo "</table>"; 
} 
ocilogoff($conn); 
print "</PRE></HTML>"; 
?> 
When i search for a value that is in the database no results are returned, however the form is definitely posting the variable as the echo statement on the PHP script displays it. Any ideas would be gratefully appreciated
Many Thanks
Paul

Do you need to set $invest before calling do_select() and pass it as a
parameter? Also, watch out for SQL Injection security risks. Try
using a bind variable.
$invest = $_POST['invest'];
echo "Returning results related to $invest";
select_data($conn, $invest);
function select_data($conn, $invest)
$stmt = ociparse($conn,"select * from investmentbase where INVTYPE=:ibv");
ocibindbyname($stmt, ':ibv', $invest);
ociexecute($stmt,OCI_DEFAULT);
. . .Although the PHP 4 naming style for oci8 functions can be used with
PHP 5, I know there is a possibility you are using the PHP 4 OCI8
extension. If you are, then upgrade at least OCI8. There are some
notes on this in
Re: frustrations with oci_fetch_array()
-- cj

How to deinstall Oracle database

I installed Oracle database 11g twice on my machine, I have dbhome_1 and dbhome_2, but I want to uninstalled dbhome_2.
I have started to uninstall it but where i hanged is where in the command prompt to : Specify all Single Instance listeners that are to be de-configured [LISTENER]:
I don't know the information to put there. I want to know what to put there.
Thanks.

Hi,
Welcome to OTN form.
Oracle support id:
Oracle De-install Utility – 11g R2 [ID 886184.1]
How To Deinstall Oracle Home In 11GR2 [ID 883743.1]
Deinstalling an ORACLE_HOME in 11gR2 DB = MORE WORK! | Oracle High Availability
Oracle De-install Utility | DBASoul.com
for Windows OS:
Deinstall Oracle 11gR2 windows | DBA
Thank you

How to uninstall Oracle Database 11g release 2?

Hi,
I want to uninstall Oracle Database 11g release 2.
Im executing the deinstall.bat that is on:
C:\app\MachineName\product\11.2.0\dbhome_2\deinstall
then in the command window, i get this message:
Specify all Single Instance listeners that are to be de-configured [LISTENER]:
What should i enter here?
what is a listener?
thanks..

mseberg wrote:
Generally the default ( return key ) is correct.
The listener is the network feature that helps you connect. It listens for new connection attempts.
I like to think of it as a traffic cop which allows a connection, but has nothing to do with afterwards.
The Listener is a named process which runs on the Oracle Server, awaiting requests from Clients to connect to the Instance.
The listener does not normally handle connections after the initial request has been done. The listener listens on a port the default is 1521.
Best Regards
msebergthanks a lot, i followed the steps and it is uninstalled now.

Oracle Database Vault vs Audit Vault and database firewall

Hi All,
I would like to know the main difference between Oracle Database Vault and Oracle Audit Vault and Database firewall.
I have read all the white papers and documents on them both and find them very similar in work process.
Only difference I see in the pricing.
I feel Oracle audit Vault can do all the work of Database Vault with added feature of proactive session monitoring.
If someone can help me based on their knowledge and experience it would be appreciated.
Thank you.

I have read the white papers of both Database Vault and Audit Vault
According to database Vault sessions can be managed using various roles created as per business requirements.
Audit vault offers same thing in terms of a firewall which manages and restrictions based on roles created .
From the white papers:
DATABAES VAULT:
Oracle Database Vault restricts access to specific areas in an Oracle database from any user, including users who have administrative access.
This enables you to apply fine_grained access control to your sensitive data in a variety of ways.
Oracle Database Vault enables you to create the following components to manage security for your database:
Realms
Command Rules
Factors
Rule Sets.
DATABAE AUDIT AND FIREWALL:
Oracle Audit Vault and database Firewall consolidates database activity monitoring events and audit logs. Policies enforce expected application behaviour, helping preventing SQL injection, application bypass, and other malicious activities from reaching the database while also monitoring and auditing privileged users and other activities inside the database.
To me these sound very similar of doing same work.
My apologies as I am unable to paste the whole text here and I cannot type full documents here

Insert into Oracle Database using C#

Hi Everyone,
I am trying to take data from text box and list box and then insert them to Oracle database:
Text box data:
Oracle = EMPLOYEE_NAME
C# = tbEmployeeName
List box data:
Oracle = EMPLOYEE_GENDER
C# = lbEmployeeGender
Here is my code in C#, can you guys help me with insert statement:
string oradb = "Data Source= oraDB;User Id=sm;Password=mypassword;";
OracleConnection conn = new OracleConnection(oradb);
conn.Open();
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
cmd.CommandText = "Insert into USER.EMPLOYEE VALUES (tbEmployeeName.Text, lbEmployeeGender.Text)";
int rowsUpdated = cmd.ExecuteNonQuery();
if (rowsUpdated == 0)
MessageBox.Show("Record not inserted");
else
MessageBox.Show("Success!");
conn.Dispose();
Thanks!

989630 wrote:
Hi Everyone,
I am trying to take data from text box and list box and then insert them to Oracle database:
Text box data:
Oracle = EMPLOYEE_NAME
C# = tbEmployeeName
List box data:
Oracle = EMPLOYEE_GENDER
C# = lbEmployeeGender
Here is my code in C#, can you guys help me with insert statement:
string oradb = "Data Source= oraDB;User Id=sm;Password=mypassword;";
OracleConnection conn = new OracleConnection(oradb);
conn.Open();
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
cmd.CommandText = "Insert into USER.EMPLOYEE VALUES (tbEmployeeName.Text, lbEmployeeGender.Text)";
int rowsUpdated = cmd.ExecuteNonQuery();
if (rowsUpdated == 0)
MessageBox.Show("Record not inserted");
else
MessageBox.Show("Success!");
conn.Dispose();
Thanks!Hi,
You'll want to read up on using parameters (also known as bind variables) - these are critical for scalability in an OLTP-type system and helping guard against SQL Injection attacks. There's many sources out there, but here's a link to the Parameter Binding section in the ODP.NET Developer's Guide which is probably a good thing to become familiar with:
http://docs.oracle.com/cd/E11882_01/win.112/e23174/featOraCommand.htm#i1007242
Here's your sample using bind variables:
string oradb = "Data Source= oraDB;User Id=sm;Password=mypassword;";
OracleConnection conn = new OracleConnection(oradb);
conn.Open();
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
// Perform insert using parameters (bind variables)
cmd.CommandText = "Insert into USER.EMPLOYEE VALUES (:1, :2)";
// Here's one way to use parameters aka bind variables:
// Create parameters to hold values from front-end
cmd.Parameters.Add(new OracleParameter("1",
                                       OracleDbType.Varchar2,
                                       tbEmployeeName.Text,
                                       ParameterDirection.Input));
cmd.Parameters.Add(new OracleParameter("2",
                                       OracleDbType.Varchar2,
                                       lbEmployeeGender.Text,
                                       ParameterDirection.Input));
int rowsUpdated = cmd.ExecuteNonQuery();
if (rowsUpdated == 0)
MessageBox.Show("Record not inserted");
else
MessageBox.Show("Success!");
conn.Dispose();
// don't forget to perform any clean-up as necessaryNote that I've just typed this into a text editor and not verified, so please excuse any typos you may find.
Also, I've allowed the default of OracleCommand.BindByName=false as I prefer that, though others certainly prefer setting it to "true". See the docs for what this means if you are not sure.
Regards,
Mark

Can we have oracle database and gateway for SLQServer on same machine

Can we install oracle database and Gateway for sQLServer on same machine>?
If yes, How does the listener files in gateway home (EG: C:\product\11.2.0\NETWORK\ADMIN) and oracle home (EG: C:\app\Administrator\product\11.2.0\dbhome_1\NETWORK\ADMIN) look like?
Where will we give dg4msql details in tnsnames and listner files?

Here is the output of starting both the listeners. This is output when i appended listener1 settings in Oracle_home listener.ora file.
C:\Users\Administrator>lsnrctl start listener
LSNRCTL for 64-bit Windows: Version 11.2.0.2.0 - Production on 03-DIC-2012 04:46
:15
Copyright (c) 1991, 2010, Oracle. All rights reserved.
Avvio di tnslsnr: attendere...
TNSLSNR for 64-bit Windows: Version 11.2.0.2.0 - Production
Il file dei parametri di sistema Þ C:\app\Administrator\product\11.2.0\dbhome_1\
network\admin\listener.ora
Messaggi di log registrati in C:\app\Administrator\diag\tnslsnr\WIN-77CAQGHJSA2\
listener\alert\log.xml
Ascolto su: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=localhost)(PORT=1521))
Connessione a (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521
STATO del LISTENER
Alias listener
Versione TNSLSNR for 64-bit Windows: Version 11.2.0.2.0 - Produ
ction
Data di inizio 03-DIC-2012 04:46:20
Tempo di attivitÓ 0 giorni 0 ore 0 min. 5 sec.
Livello trace off
Sicurezza ON: Local OS Authentication
SNMP OFF
File di parametri listenerC:\app\Administrator\product\11.2.0\dbhome_1\network\a
dmin\listener.ora
File di log listener C:\app\Administrator\diag\tnslsnr\WIN-77CAQGHJSA2\list
ener\alert\log.xml
Summary table degli endpoint di ascolto...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=localhost)(PORT=1521)))
Summary table dei servizi...
Il servizio "test" ha 1 istanze.
L'istanza "test", stato UNKNOWN, ha 1 handler per questo servizio...
Il comando Þ stato eseguito
C:\Users\Administrator>lsnrctl start listener1
LSNRCTL for 64-bit Windows: Version 11.2.0.2.0 - Production on 03-DIC-2012 04:46
:23
Copyright (c) 1991, 2010, Oracle. All rights reserved.
Avvio di tnslsnr: attendere...
TNSLSNR for 64-bit Windows: Version 11.2.0.2.0 - Production
Il file dei parametri di sistema Þ C:\app\Administrator\product\11.2.0\dbhome_1\
network\admin\listener.ora
Messaggi di log registrati in D:\product\11.2.0\tg_2\diag\tnslsnr\WIN-77CAQGHJSA
2\listener1\alert\log.xml
Ascolto su: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=localhost)(PORT=1522))
Connessione a (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1522
STATO del LISTENER
Alias listener1
Versione TNSLSNR for 64-bit Windows: Version 11.2.0.2.0 - Produ
ction
Data di inizio 03-DIC-2012 04:46:29
Tempo di attivitÓ 0 giorni 0 ore 0 min. 5 sec.
Livello trace off
Sicurezza ON: Local OS Authentication
SNMP OFF
File di parametri listenerC:\app\Administrator\product\11.2.0\dbhome_1\network\a
dmin\listener.ora
File di log listener D:\product\11.2.0\tg_2\diag\tnslsnr\WIN-77CAQGHJSA2\li
stener1\alert\log.xml
Summary table degli endpoint di ascolto...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=localhost)(PORT=1522)))
Summary table dei servizi...
Il servizio "dg4msql" ha 1 istanze.
L'istanza "dg4msql", stato UNKNOWN, ha 1 handler per questo servizio...
Il comando Þ stato eseguito
C:\Users\Administrator>sqlplus /nolog
SQL*Plus: Release 11.2.0.2.0 Production on Lun Dic 3 04:46:34 2012
Copyright (c) 1982, 2010, Oracle. All rights reserved.
SQL> conn system/Manager1@star
Connesso.
SQL> create public database link test2 connect to "sa" identified by "pwd"
using 'dg4msql';
Creato database link.
SQL> select count(*) from prefer@test2;
select count(*) from prefer@test2
ERRORE alla riga 1:
ORA-28545: errore diagnosticato da Net8 durante la connessione a un agente
Unable to retrieve text of NETWORK/NCR message 65535
ORA-02063: precedente 2 lines da TEST2
Output of tnsping from oracle_home
C:\Users\Administrator>tnsping dg4msql
TNS Ping Utility for 64-bit Windows: Version 11.2.0.2.0 - Production on 03-DIC-2
012 05:01:28
Copyright (c) 1997, 2010, Oracle. All rights reserved.
File di parametri utilizzati:
C:\app\Administrator\product\11.2.0\dbhome_1\network\admin\sqlnet.ora
╚ stato utilizzato l'adattatore TNSNAMES per risolvere l'alias
Tentativo di contattare (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1522)) (CONNECT_DATA = (SERVICE_NAME = dg4msql)) (HS=OK))
OK (0 msec)
tnsnames.ora file at D:\product\11.2.0\tg_2\NETWORK\ADMIN
dg4msql =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1522))
(CONNECT_DATA = (SERVICE_NAME = dg4msql))
(HS=OK)
C:\app\Administrator\product\11.2.0\dbhome_1\NETWORK\ADMIN
LISTENER_test=
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
dg4msql =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1522))
(CONNECT_DATA = (SERVICE_NAME = dg4msql))
(HS=OK)
test=
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = test)
)

Oracle databases vulnerable to injected listeners

Similar Messages

Maybe you are looking for