In this Document

Applies to:

Goal

To demonstrate how the COST parameter "SECURE_REGISTER_listener_name =" is used to restrict instance registration with database listeners. With this COST restriction in place only local instances will be allowed to register. These instructions can be used to address the issues published in Oracle Security Alert CVE-2012-1675 by using COST to restrict connections to only local instances.

About COST

The class of secure transports (COST) parameters specify a list of transports that are considered secure for administration and registration of a particular listener. The COST parameters identify which transports are considered secure for that installation and whether the administration of a listener requires secure transports. COST will not affect client connections utilizing other protocols. For more details and for information about other available COST parameters please see the 11.2 Network Administrators Guide and Network Reference.

About the IPC Protocol

IPC protocol support is similar to BEQ protocol support in that it can only be used when the client program and the Oracle server are installed on the same system. IPC protocol support differs from BEQ protocol support in that it can be used with Oracle Shared Server configurations. IPC protocol support requires a listener for its operation. For more information about IPC please see Doc ID 29232.1 "IPC Exlplained".

Oracle versions that support COST

Although not documented in the Oracle 10g Network Administration Guides COST parameters and functionality are supported as of 10.2.0.3.

Fix

Topics in this section:

1) Setting a COST restriction using the TCP protocol to limit registration to local instances.

2) Setting a COST restriction using the IPC protocol to limit registration to local instances.

3) Verifying that COST is working.

1) Setting a COST restriction using the TCP protocol to limit registration to local instances.

Steps:

1.1) Obtain and apply the patch for bug:12880299.

1.2) Add the COST TCP protocol restriction "SECURE_REGISTER_listener_name = (TCP)" to the listener.ora.

1.3) Restart the listener.

The listener will now only accept database registration information from the local database and over TCP.

With COST enabled for the TCP protocol attempts to register with the listener from anything other than the local system using TCP is rejected and an event is logged in the listener log.

2) Setting a COST restriction using the IPC protocol to limit registration to local instances.

Steps:

2.1) Stop the listener

2.2) If it does not already exist, add support for the IPC protocol to the listener configuration " (ADDRESS= (PROTOCOL = IPC) (KEY = REGISTER)) ". If you already have an IPC key defined you may use it as is. Also add the COST parameter " SECURE_REGISTER_listener_name = (IPC) ".

2.3) Start the listener.

2.4) Replace the TCP address in the database local_listener parameter with the IPC address used by the listener.

2.5) Verify that the instance is now registered with the listener.

With COST enabled attempts to register with the listener using a protocol other than IPC is rejected and an event is logged in the listener log.

3) Verifying that COST is working

Overview: To confirm the functionality of a COST configuration in a standalone database environment start the COST protected listener and attempt to register with it from a remote machine. A remotely registered instance will display as "REMOTE SERVER" in lsnrctl services output.

This is just one example of how to check. Configurations and listener output may vary per setup but the test logic remains the same; can an unauthorized protocol register with the listener?. This same testing methodology can be used for COST restrictions using IPC, TCP or TCPS protocol or any combinatons thereof.

Test Logic: First ensure that remote registration will take place with COST disabled, then re-enable COST and verify that it is restricting the same remote registration attempts.

Steps:

3.1) Comment the COST rule in listener.ora and restart the listener.

3.2) At the remote system that will be sending registration information to the listener being tested, load the target listeners TCP address into the database initialization parameter "remote_listener=". Enclose the address in single quotes and use the scope clause "scope=memory;". This action will tell the instance to also send registration packets to the remote listener over TCP.

3.3) Back at the listener you should now see a service handler created for the remotely registered instance. Notice how it is listed as a REMOTE SERVER.

3.4) With remote registration confirmed test COST. Remove the comment from the COST parameter in the listener.ora and restart the listener. COST is now protecting the listener from registration attempts that are not coming from the local node.

3.5) At the remote instance force another registration attempt by issuing the SQL command "alter system register;" .

3.6) Check the listener for service handlers, no handlers for REMOTE SERVER(s) should be seen.

3.7) Check the listener log, TNS-01194 messages will occur with each registration attempt that was refused.

With COST enabled the results of steps 3.6 and 3.7 above are expected and confirm that the COST registration restriction is working properly.

3.8) When finished testing clear the remote_listener value of the remote instance either by restarting or replacing the parameter in memory with a null string.

References