Database Software

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

Oracle TNS is vulnerable to poisoning attack

AmiWMay 31 2016 — edited Jun 3 2016

Oracle 11.2.0.4 PSU22310544 on Windows Server 2008

I was reading about CVE-2012-1675 alert. I did follow Doc ID 1453883.1 for Oracle Database deployments that do not use RAC. Unfortunately, the workaround doesn't make much sense to me compared to this article , and this article. Then I got to this discussion and got even more confused.

On the Burleson Consulting article, "If you set set dynamic_registration_listener=off in the in your listener.ora file then you are completely protected against this TNS poison attack.". My question is what is the impact of setting dynamic_registration_listener to off? Is it really as simple. Why does Oracle Doc did not mention that as a workaround?

Can someone please explain what this alert is about? And possibly the least "harmful" way to mitigate this risk?

Thanks

Ami

Locked Post

New comments cannot be posted to this locked post.

Locked on Jul 1 2016

Added on May 31 2016

#database-security, #database-security-general

4 comments

2,116 views