Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
Oracle - Security Alert for CVE-2012-1675 - TNS listener
- http://www.oracle.co...75-1608180.html
2012-April-30 - "This security alert addresses the security issue CVE-2012-1675, a vulnerability in the TNS listener which has been recently disclosed as "TNS Listener Poison Attack" affecting the Oracle Database Server. This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to impact the confidentiality, integrity and availability of systems that do not have recommended solution applied.
Affected Products and Versions:
Oracle Database 11g Release 2, versions 11.2.0.2, 11.2.0.3
Oracle Database 11g Release 1, version 11.1.0.7
Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4, 10.2.0.5
Solution:
Recommendations for protecting against this vulnerability can be found at:
- http://support.oracl...mp;id=1340831.1 - for Oracle Database deployments that use Oracle Real Application Clusters (RAC).
- http://support.oracl...mp;id=1453883.1 - for Oracle Database deployments that do not use RAC.
Please note that Oracle has added Oracle Advanced Security SSL/TLS to the Oracle Database Standard Edition license when used with the Real Application Clusters and Oracle has added Oracle Advanced Security SSL/TLS to the Enterprise Edition Real Application Clusters (Oracle RAC) and RAC One Node options so that the directions provided in the Support Notes referenced above can be applied by all Oracle customers without additional cost..."
___
- http://www.securityt....com/id/1027000
May 2 2012
CVE Reference: CVE-2012-1675
Impact: User access via network
Version(s): 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3; and prior versions
Description: A vulnerability was reported in Oracle Database. A remote user can hijack database instance connections...
Solution: No solution was available at the time of this entry.
The vendor has issued recommendations in the following support notes:
- My Oracle Support Note 1340831.1 for Oracle Database deployments that use Oracle Real Application Clusters (RAC):
http://support.oracl...mp;id=1340831.1
- My Oracle Support Note 1453883.1 for Oracle Database deployments that do not use RAC
http://support.oracl...mp;id=1453883.1 ...
___
- https://blogs.oracle...rt_for_cve_2012
Apr 30, 2012
- http://h-online.com/-1565661
2 May 2012
Edited by AplusWebMaster, 03 May 2012 - 12:56 AM.
