TNS Listener Poison attack

Question

Hi Gurus,
Recently i came across an alert from Oracle, which talks about TNS Listener Poison attack in Oracle database environment, which i do not understand how can someone attack the listener and get access to the database. is it possible to provide a scenario as an example.
Thanks in advance.

Answer 1

TNS Listener Poison Attack
The Oracle database server has a separate network connection process that usually operates on TCP port 1521. The database registers as a listener with this process and the process forwards the client requests on to the actual database system that handles the requested database instance.
Since version 8i, these network connection processes can register additional listeners. Such a listener can even be registered for an existing database instance. The active listener interprets this as a new Oracle Real Application Clusters (RAC) node and uses the new listener to implement load balancing. In other words: every second database connection will be routed via the new listener.
This security hole is particularly serious "because it allows remote and unauthenticated attackers to redirect the database's network traffic on the database server to an arbitrary server and then intercept it. All they need to know is the Oracle SID or Oracle service name."
Immediate solution for non-cluster envernment:
dynamic_registration_<listener> = off
For Example:
Step 1
======
LSNRCTL> show dynamic_registration
Connecting to (ADDRESS=(PROTOCOL=IPC)(KEY=XS2.WORLD))
LISTENER parameter "dynamic_registration" set to ON
The command completed successfully
Step 2
======
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = hostname)(PORT = 1521))
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(SID_NAME = PLSExtProc)
(ORACLE_HOME = /u01/app/oracle/product/11.2.0.2)
(PROGRAM = extproc)
(SID_DESC =
(global_dbname = ORCL.hostname)
(ORACLE_HOME = /u01/app/oracle/product/11.2.0.2)
(sid_name = hostname)
ADR_BASE_LISTENER = /u01/app/oracle
INBOUND_CONNECT_TIMEOUT_ = 120
DYNAMIC_REGISTRATION_LISTENER = off
Conclusion:
The attack is on the Listener itself - so if you want to prevent this attack, you need to secure that Listener, irrespective of its location.
Note: Mandatory if we expose our Listener to an unsecured or public network (e.g. internet).
As for Listeners running on your internal network - Internal network already needs to be compromised in order for the attack to occur.
http://shanojkumar.wordpress.com/2012/05/23/oracle-security-alert-for-cve-2012-1675-tns-listener-poison-attack/