Weblogic修復"Java反序列化"過程遠端命令執行漏洞

1.查詢文件說明，在上找到補丁的說明文件如下：

CVE-2015-4852 Patch Availability Document for Oracle WebLogic Server Component of Oracle Fusion Middleware (Doc ID 2075927.1)

APPLIES TO:

Oracle WebLogic Server - Version 10.3.6 to 12.2.1.0.0
Oracle Fusion Middleware
Oracle WebLogic Server - Version 10.3 to 10.3
Information in this document applies to any platform.
This applies to any product deployment using Oracle WebLogic Server

PURPOSE

This document defines minimum releases and patches for the Oracle WebLogic Server component of Oracle Fusion Middleware to address the vulnerability described in the Oracle Security Alert for CVE-2015-4852:  http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html

DETAILS

It is important to read the Oracle Security Alert before reading this document. The table below defines minimum releases and patches for Oracle WebLogic Server.

See also Note 2076338.1 CVE-2015-4852 Mitigation Recommendations for Oracle WebLogic Server Component of Oracle Fusion Middleware

n January 2016 CPU Update:

Beginning January 2016, CVE-2015-4852 fixes are now included in the below Patch Set Update (PSU) releases and higher:

12.2.1.0.1

12.1.3.0.6

12.1.2.0.8

10.3.6.0.13

n To obtain the latest cumulative PSU, refer to the Critical Patch Update program at http://www.oracle.com/technetwork/topics/security/alerts-086861.html . Review the latest Advisory and click the "Fusion Middleware" link within to obtain the latest cumulative Patch Availability Document.

n Important: If you have a version older than 10.3.6 or 12.1.2, you must upgrade as per the Error Correction Policy: Note 950131.1, "Error Correction Support Dates for Oracle WebLogic Server".

n The initial patching requirements from November 2015 are listed below with patch links for all versions under error correction support:

WLS Release	Required Patches
12.2.1.0	for CVE-2015-4852
12.1.3.0	PSU 12.1.3.0.5 () + Patch 22248372 for CVE-2015-4852
12.1.2.0	PSU 12.1.2.0.7 () +  for CVE-2015-4852
10.3.6.0	PSU 10.3.6.0.12 (), Smart Update Patch ID: EJUW) +  for CVE-2015-4852

l Patches are not password protected for versions listed above. Older versions are now expired.

l Due to issues with linking to the standard My Oracle Support patch download page, the above links go to an alternative updates.oracle.com location. If you have firewall rules on your network, you should adjust accordingly for the links to work.

l You may also access these patches by going to the "Patches and Updates" tab, perform a search on the above numbers and select your version.

REFERENCES

NOTE:2076338.1 - CVE-2015-4852 Mitigation Recommendations for Oracle WebLogic Server Component of Oracle Fusion Middleware

NOTE:1074055.1 - Security Vulnerability FAQ for Oracle Database and Fusion Middleware Products

2.下載補丁，透過原文Required Patches處的連結下載補丁包。我所使用的版本為10.3.6.0，所以需要下載的補丁包為PSU 10.3.6.0.12 (Patch 20780171) + 10.3.6.0.12 Patch 22248372 for CVE-2015-4852

3.執行打補丁操作（注意：不同的環境和本文的路徑會有所不同）

4.檢視剛更新的補丁資訊


5.附錄（README檔案：Patch 20780171）

1. Oracle WebLogic Server Patch Set Update 10.3.6.0.12 README
   
2. =========================================================
   
3. 
   
4. This README provides information about how to apply Oracle WebLogic Server
   
5. Patch Set Update 10.3.6.0.12. It also provides information about reverting to
   
6. the original version.
   
7. 
   
8. Released: July, 2015
   
9. 
   
10. 
    
11. Smart Update Details of Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    
12. --------------------------------------------------------------------------
    
13. 
    
14. PATCH_ID - EJUW
    
15. Patch number - 20780171
    
16. 
    
17. 
    
18. Preparing to Install Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    
19. -----------------------------------------------------------------------
    
20. 
    
21. - WebLogic Server Patch Set Update (PSU) can be applied on a per-domain basis
    
22.   (or on a more fine-grained basis), Oracle recommends that PSU be applied on an installation-wide basis.
    
23.   PSU applied to a WebLogic Server installation using this recommended practice
    
24.   affect all domains and servers sharing that installation.
    
25. - Login as same "user" with which the component being patched is installed.
    
26. - Stop all WebLogic servers.
    
27. - Remove any previously applied WebLogic Server Patch Set Update and associated overlay patches
    
28. 
    
29. 
    
30. Installing Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    
31. -------------------------------------------------------------
    
32. 
    
33.  - unzip p20780171_1036_Generic.zip to {MW_HOME}/utils/bsu/cache_dir or any local directory
    
34.    
    
35.    Note: You must make sure that the target directory for unzip has required write and executable permissions
    
36.          for "user" with which the component being patched is installed.
    
37. 
    
38.  - Navigate to the {MW_HOME}/utils/bsu directory.
    
39.  - Execute bsu.sh -install -patch_download_dir={MW_HOME}/utils/bsu/cache_dir -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}
    
40. 
    
41.    Where, WL_HOME is the path of the WebLogic home
    
42. 
    
43.    Reference: BSU Command line interface
    
44.               http://docs.oracle.com/cd/E14759_01/doc.32/e14143/commands.htm
    
45. 
    
46. 
    
47. Post-Installation Instructions
    
48. ------------------------------
    
49. 
    
50. a) Restart all WebLogic servers.
    
51. 
    
52. b) The following command is a simple way to determine the application of WebLogic Server PSU.
    
53. 
    
54.   $ . $WL_HOME/server/bin/setWLSEnv.sh
    
55.   $ java weblogic.version
    
56. 
    
57. In the following example output, 10.3.6.0.12 is the installed WebLogic Server PSU.
    
58. 
    
59.       WebLogic Server 10.3.6.0.12 PSU Patch for BUG20780171
    
60. 
    
61. 
    
62. Uninstalling Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    
63. ---------------------------------------------------------------
    
64. 
    
65.  - Stop all WebLogic Servers
    
66.  - Navigate to the {MW_HOME}/utils/bsu directory.
    
67.  - Execute bsu.sh -remove -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}
    
68. 
    
69. 
    
70. Post-Uninstallation Instructions
    
71. --------------------------------
    
72. 
    
73. a) Restart all WebLogic Servers.
    
74. 
    
75. 
    
76. Oracle recommends that you see following key notes
    
77. --------------------------------------------------
    
78. 
    
79. - My Oracle Support NOTE: 1306505.1 Announcing Oracle WebLogic Server PSUs (Patch Set Updates)
    
80. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1306505.1
    
81. 
    
82. - My Oracle Support NOTE: 1470197.1 Master Note on WebLogic Server Patch Set Updates (PSUs)
    
83. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1470197.1
    
84.  
    
85. - My Oracle Support NOTE: 1471192.1 - Replacement Patches for WebLogic Server PSU Conflict Resolution
    
86. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1471192.1
    
87. 
    
88. - SSL Authentication Problem Using WebLogic 10.3.6 and 12.1.1 With JDK1.7.0_40 or Higher
    
89. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1607170.1
    
90.  
    
91. - Smart Update Applying Patches to Oracle WebLogic Server
    
92. http://docs.oracle.com/cd/E14759_01/doc.32/e14143/intro.htm
    
93. 
    
94. 
    
95. ==========================================================================
    
96. Copyright ?2010, 2011, Oracle and/or its affiliates. All rights reserved.
    
97. 
    
98. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.
    
99. 
    
100. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.
     
101. 
     
102. If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:
     
103. 
     
104. U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.
     
105. 
     
106. This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.
     
107. 
     
108. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
     
109. 
     
110. This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.
     
111. ==========================================================================