干货 | Oracle数据库关于CVE-2018-3110安全漏洞的预警及修复建议

官方英文描述：

This Security Alert addresses an Oracle Database vulnerability in versions 11.2.0.4 and 12.2.0.1 on Windows. CVE-2018-3110 has a CVSS v3 base score of 9.9, and can result in complete compromise of the Oracle Database and shell access to the underlying server. CVE-2018-3110 also affects Oracle Database version 12.1.0.2 on Windows as well as Oracle Database on Linux and Unix, however patches for those versions and platforms were included in the July 2018 CPU.

If you are running Oracle Database versions 11.2.0.4 and 12.2.0.1 on Windows, please apply the patches indicated below. If you are running version 12.1.0.2 on Windows or any version of the database on Linux or Unix and have not yet applied the July 2018 CPU, please do so.

select * from v$version

opatch  lsinv

column comp_name format a30

column version format a20

column status format a15

column owner format a30

column object_name format a30

column object_type format a15

column long_name format a75

column role format a40

column act_time format a24

column action format a15

column comments format a20

set pagesize 500

set linesize 150

set trimspool on

set serveroutput on

set echo on

spool jvm_info.log

------ REGISTRY INFO ------

SELECT SUBSTR(comp_name, 1, 30) comp_name, SUBSTR(version, 1, 20) version, status 

FROM dba_registry

ORDER BY comp_name;

------ REGISTRY HISTORY -------

SELECT TO_CHAR(action_time, 'DD-MON-YYYY HH24:MI:SS') act_time, action, version, id, comments

FROM dba_registry_history

ORDER BY action_time DESC;

------ JAVA OBJECT INFO ------

-- Are there a substantial number of VALID Java objects in SYS?

SELECT owner, object_type, status, COUNT(*)

FROM dba_objects

WHERE object_type LIKE '%JAVA%'

GROUP BY owner, object_type, status

ORDER BY owner, object_type, status;

-- Is the DBMS_JAVA package VALID?

SELECT owner, object_name, object_type, status

FROM dba_objects

WHERE object_name LIKE 'DBMS_JAVA%'

OR object_name LIKE '%INITJVMAUX%'

ORDER BY owner, object_name, object_type;

-- Are there any INVALID Java objects in SYS?

SELECT owner, NVL(longdbcs,object_name) long_name, object_type, status

FROM dba_objects, sys.javasnm$

WHERE object_type LIKE '%JAVA%'

AND status <> 'VALID'

AND short (+) = object_name

ORDER BY owner, long_name, object_type;

------ JAVA ROLE INFO ------

-- The number expected varies by release.

SELECT role

FROM dba_roles

WHERE role LIKE '%JAVA%'

ORDER BY role;

------ MEMORY INFO ------

SELECT *

FROM v$sgastat

WHERE pool = 'java pool' OR name = 'free memory'

ORDER BY pool, name;

------ DATABASE PARAMETER INFO ------

show parameter pool_size

show parameter target

show parameter sga

------ TEST JAVAVM USAGE (and return the JDK version if > 11g) ------

-- Calling routines in DBMS_JAVA will invoke the JavaVM and expose certain problems.

SET SERVEROUTPUT ON

DECLARE

 v

Database PSU 11.2.0.4.180717 Patch 27734982

GI PSU 11.2.0.4.180717 Patch 27967757

Oracle JavaVM (OJVM) Component Database PSU 11.2.0.4.180717 Patch 27923163

### Replacing the Java system classes while database is up

cd $ORACLE_HOME/sqlpatch/#patch#

sqlplus nolog

SQL>connect as sysdba

SQL>@postinstall.sql

### verify patch

set lines 200

select comments, action,version, ID, action_time from dba_registry_history;

### If any packages are invalid

SELECT owner, object_name, object_type from dba_objects where status = 'INVALID'

### recompile the objects

SQL>@?/rdbms/admin/utlrp.sql

Installation

-----------------

To install the patch, follow these steps:

1. Set your current directory to the directory where the patch is located and then run the OPatch utility by entering the following commands:

$ cd <PATCH_TOP_DIR>/19721304

$ opatch apply

2. Verify whether the patch has been successfully installed by running the following command:

$ opatch lsinventory

Postinstallation

----------------------

The following steps load modified SQL files into the database. Note: Perform these steps on each database in the ORACLE_HOME.

1.For each database instance running on the Oracle home being patched, connect to the database using SQL*Plus. Connect as SYSDBA and run the below script as follows:

$ sqlplus /nolog

SQL> CONNECT / AS SYSDBA

SQL> @?/sqlpatch/19721304/postinstall.sql

安装完成后执行禁用操作:

exec dbms_java_dev.disable;