Fusion | Blog

Update Oracle Security Alert - January 2012

admin — Mon, 02 Apr 2012 09:18:09 +0000

Oracle Security Alert for CVE-2011-5035 that was originally released on Tuesday, January 31, 2012 has been updated to announce additional products that are impacted by this vulnerability through their use of affected components.

Oracle strongly recommends applying Security Alert fixes as soon as possible.

The Security Alert Advisory is the starting point for relevant information. It includes the list of affected products, a summary of the security vulnerability, and a pointer to obtain the latest patches.

Also, it is essential to review the Security Alert supporting documentation referenced in the Advisory before applying patches, as this is where you can find important pertinent information.

The Advisory is available at the following location:

Oracle Critical Patch Updates and Security Alerts:
http://www.oracle.com/technetwork/topics/security/alerts-086861.html

Updated Oracle Security Alert CVE-2011-5035:
http://www.oracle.com/technetwork/topics/security/alert-cve-2011-5035-1506603.html

Corrupt INST_TOP ??

admin — Wed, 03 Aug 2011 10:36:12 +0000

We recently resolved an issue in R12 Apps with missing environment configuration and INST_TOP scripts by retrieving the context file from the database, using the following steps on each apps tier:

1) Retrieve context file from database

cd $COMMON_TOP/clone/bin

perl adclonectx.pl retrieve

[enter db node 1 details and SID, then choose the correct context file to retrieve from database]

2) Run autoconfig

cd $AD_TOP/bin

perl adconfig.pl

[enter context file produced in step 1]

3) Kill any existing processes and restart using adstrtal.sh

Oracle release critical patch update - July 19th 2011

admin — Tue, 19 Jul 2011 21:23:55 +0000

The Critical Patch Update Advisory is available at the following location:

Oracle Technology Network
http://www.oracle.com/technetwork/topics/security/alerts-086861.html

Unix - tar directory structure

admin — Thu, 31 Mar 2011 10:42:07 +0000

Here’s a useful little piece of shell to tar up a directory structure (without files) - we used this recently as part of a clone operation to discard a rather large, unkempt log history…!

Firstly - thanks to Unix guru Mik for providing the base of this solution here: http://www.linuxquestions.org/questions/linux-general-1/can-i-tar-a-directory-structure-46165/

We hit a couple of issues around sub-directory names containing spaces, so have adapted it to cope with this using some perl to place “quotes” around the subdirectory string.

We also added a further search and replace to prevent it trying to recreate the base directory.

Subtitute the variables in bold

mkdir /tmp/temp_dirstr

cd /tmp/temp_dirstr

find -type d | sed -e ’s%/%%’|sed -e ’s%%%’ | perl -pe ’s{^}{\”};s{$}{\”}’ | xargs mkdir

tar cvfz /tmp/.tgz *

rm -Rf /tmp/temp_dirstr

stopManagedWebLogic.sh - Stopping a managed server from the command line

admin — Fri, 25 Feb 2011 12:07:09 +0000

We came across a couple of ‘gotchas’ whilst putting a service start/stop shell script together for UCM on Red Hat Linux.

Stopping a managed server in Weblogic 10.3.4….

The $DOMAIN_HOME/bin/stopManagerWebLogic.sh script utilises WLST (Weblogic Scripting Tool) to shut down a managed server.

1. This cannot communicate with the Admin server over http, and so requires the t3 protocol.

2. Also, given that it is WLST, we need to pass the username and password in standalone fashion (not as java startup parameters as we do when starting the managed server)

e.g. The command to stop the WLS_UCM1 managed server is:

nohup ./stopManagedWebLogic.sh WLS_UCM1 t3://ucmhost.fusion-its.com:7001 weblogic &

Without these parameters, you may receive the following errors when trying to run stopManagedWeblogic.sh:

1. WLSTException: Error occured while performing connect : Error getting the initial context. There is no server running at http://ucmhost.fusion-its.com:7001

Problem: WRONG PROTOCOL - NEEDS t3

2. WLSTException: Error occured while performing connect : User: -Dweblogic.management.username=weblogic, failed to be authenticated.

Problem: WRONG USER CREDENTIAL PARAMETERS SET

ORA-01408 - R12 database 11g upgrade errors - 10.2.0.4 - 11.2.0.2

admin — Fri, 18 Feb 2011 09:55:15 +0000

We recently received ORA-01408: such column list already indexed whilst running the 11.2.0.2 db upgrade assistant against a 10.2.0.4 12.0.6 E-Business Suite database.

Checking the dbua log file (Oracle_Server.log) - revealed the offending statement:

create index system.repcat$_audit_column_f2_idx

Resolution:

Logon using 11.2.0.2 sqlplus and drop/recreate the offending index

Oracle Directory Manager 10.1.4 Client

admin — Tue, 28 Jul 2009 15:39:39 +0000

Fed up of having to launch an X-Window client to run the correct version of Directory Manager to view and edit your 10.1.4 OID?

There is a process to install just the 10.1.4 ODM client on your local workstation, just take a look at Metalink note 391620.1.

Download the client for ODM 10.1.4.3 via the following link, then follow the instructions below to install (these basically follow the note, but we have removed unecessary steps and included steps to avoid a few pitfalls we ran into).

client10143.zip

1. If possible, to avoid having to make too many changes to the configuration files, unpack the zip file into C:\oracle

2.Check if the unpacked software contains the two required shortcuts. If you were able to copy the software under C:\ORACLE, then move these shortcuts to the desktop.

If not, create the following two shortcuts for Oracle Directory Manager and Oracle DIP Admin respectively (right-click on desktop, ‘New’ > ‘Shortcut’).

N.B. Replace%ORACLE_HOME% with the full path of the client software home directory.

Target: %ORACLE_HOME%\BIN\launch.exe “%ORACLE_HOME%\ldap\oidadmin” oidadmin.cl Start in:%ORACLE_HOME%\ldap\oidadmin
Target: %ORACLE_HOME%\BIN\launch.exe “%ORACLE_HOME%\ldap\oidadmin” dipadmin.cl Start in:%ORACLE_HOME%\ldap\oidadmin

3. Double-click your way to 10.1.4.3 client heaven…… :o) !!!

11g Fusion Middleware released….

admin — Wed, 08 Jul 2009 12:18:51 +0000

Released on 1st July, and referred to as a “complete, integrated, and hot-pluggable” middleware set of suites, the new software infrastructure offers integration and business intelligence (BI) benefits across its vast product portfolio, including new capabilities for Oracle SOA Suite, WebLogic Suite, Web Center Suite, and an opening debut for Identity Management as a suite.

Oracle 11g - ALTER USER IDENTIFIED BY VALUES……..

admin — Fri, 05 Jun 2009 08:46:21 +0000

How many times has that command saved a DBA from the chore of polling developers and users for passwords in order to test and troubleshoot urgent issues…?

Well with the introduction of enhanced security in Oracle Database 11g, that simple script that could effectively ’su’ to another user, then reset their password back will no longer work……

This classic ’su.sql’ script recorded the ‘password’ column value from DBA_USERS for the user in question, then temporarily changed the user’s password, logged in as the user, and then immediately reset the password back to the original value, leaving the DBA connected as the user in question.

Here is that old script (N.B. this is still very useful for pre-11g databases!) :-

N.B. Wordpress auto-formatting will helpfully spoil any attempt to cut-paste straight into putty - so you may need to replace the ‘quotes’ :o)

——————————————————————–

– su.sql

–

– Script to log onto another user’s account - requires to be run under a user with the DBA role

–

– Parameters to pass: name of the target user - e.g. @su.sql

–

set head off

set feed off

set verify off

set pages 0

set termout off

spool user.sql

select ‘alter user ‘||username||’ identified by values ”’||password||”’;’ from dba_users where username=upper(’&&1′); spool off

alter user &&1 identified by temppswd;

connect &&1/temppswd

@user.sql

set head on

set feed on

set verify on

set pages 24

set termout on

——————————————————————–

In Oracle 11g, the password field of the DBA_USERS view is no longer populated. Instead we must adapt the script to utilise two columns from SYS.USER$; the old DES encrypted password field and also a new SHA-1 encrypted hash:

——————————————————————————

– su_11g.sql

–

– 11g Script to log onto another user’s account - requires to be run under a user with

– the SYSDBA role

–

– Parameters to pass: name of the target user - e.g. @su.sql

–

set head off

set feed off

set verify off

set pages 0

set termout off

spool user11g.sql

select ‘alter user ‘||name||’ identified by values ”’||spare4||’;'||password||”’;’

from sys.user$

where name=upper(’&&1′);

spool off