溫馨提示×

溫馨提示×

您好，登錄后才能下訂單哦！

密碼登錄×
登錄注冊×
其他方式登錄
點擊 登錄注冊 即表示同意《億速云用戶服務條款》

Weblogic如何修復"Java反序列化"過程遠程命令執(zhí)行漏洞

發(fā)布時間：2022-01-15 10:42:58 來源：億速云 閱讀：148 作者：小新 欄目：大數(shù)據(jù)

小編給大家分享一下Weblogic如何修復"Java反序列化"過程遠程命令執(zhí)行漏洞，希望大家閱讀完這篇文章之后都有所收獲，下面讓我們一起去探討吧！

1.查找文檔說明，在https://support.oracle.com上找到補丁的說明文檔如下：

CVE-2015-4852 Patch Availability Document for Oracle WebLogic Server Component of Oracle Fusion Middleware (Doc ID 2075927.1)

APPLIES TO:

Oracle WebLogic Server - Version 10.3.6 to 12.2.1.0.0
Oracle Fusion Middleware
Oracle WebLogic Server - Version 10.3 to 10.3
Information in this document applies to any platform.
This applies to any product deployment using Oracle WebLogic Server

PURPOSE

This document defines minimum releases and patches for the Oracle WebLogic Server component of Oracle Fusion Middleware to address the vulnerability described in the Oracle Security Alert for CVE-2015-4852:  http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html

DETAILS

It is important to read the Oracle Security Alert before reading this document. The table below defines minimum releases and patches for Oracle WebLogic Server.

See also Note 2076338.1 CVE-2015-4852 Mitigation Recommendations for Oracle WebLogic Server Component of Oracle Fusion Middleware

n January 2016 CPU Update:

Beginning January 2016, CVE-2015-4852 fixes are now included in the below Patch Set Update (PSU) releases and higher:

12.2.1.0.1

12.1.3.0.6

12.1.2.0.8

10.3.6.0.13

n To obtain the latest cumulative PSU, refer to the Critical Patch Update program at http://www.oracle.com/technetwork/topics/security/alerts-086861.html . Review the latest Advisory and click the "Fusion Middleware" link within to obtain the latest cumulative Patch Availability Document.

n Important: If you have a version older than 10.3.6 or 12.1.2, you must upgrade as per the Error Correction Policy: Note 950131.1, "Error Correction Support Dates for Oracle WebLogic Server".

n The initial patching requirements from November 2015 are listed below with patch links for all versions under error correction support:

WLS Release

Required Patches

12.2.1.0 Patch 22248372 for CVE-2015-4852
12.1.3.0 PSU 12.1.3.0.5 (Patch 21370953) + Patch 22248372 for CVE-2015-4852
12.1.2.0 PSU 12.1.2.0.7 (Patch 21364493) + Patch 22248372 for CVE-2015-4852
10.3.6.0 PSU 10.3.6.0.12 (Patch 20780171), Smart Update Patch ID: EJUW) + Patch 22248372 for CVE-2015-4852

l Patches are not password protected for versions listed above. Older versions are now expired.

l Due to issues with linking to the standard My Oracle Support patch download page, the above links go to an alternative updates.oracle.com location. If you have firewall rules on your network, you should adjust accordingly for the links to work.

l You may also access these patches by going to the "Patches and Updates" tab, perform a search on the above numbers and select your version.

REFERENCES

NOTE:2076338.1 - CVE-2015-4852 Mitigation Recommendations for Oracle WebLogic Server Component of Oracle Fusion Middleware

NOTE:1074055.1 - Security Vulnerability FAQ for Oracle Database and Fusion Middleware Products

2.下載補丁，通過原文Required Patches處的鏈接下載補丁包。我所使用的版本為10.3.6.0，所以需要下載的補丁包為PSU 10.3.6.0.12 (Patch 20780171) + 10.3.6.0.12 Patch 22248372 for CVE-2015-4852

3.執(zhí)行打補丁操作（注意：不同的環(huán)境和本文的路徑會有所不同）

  1. [cams@JJ129077 dateFiles]$ cd /home/cams/bea/middleware/wlserver_10.3/server/bin/

  2. [cams@JJ129077 bin]$ ls

  3. international  setWLSEnv.sh  startNodeManager.sh

  4. [cams@JJ129077 bin]$ . ./setWLSEnv.sh

  5. CLASSPATH=/home/cams/bea/middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/home/cams/bea/middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/usr/java/jdk1.6.0_45/lib/tools.jar:/home/cams/bea/middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/home/cams/bea/middleware/wlserver_10.3/server/lib/weblogic.jar:/home/cams/bea/middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/home/cams/bea/middleware/wlserver_10.3/server/lib/webservices.jar:/home/cams/bea/middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/home/cams/bea/middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:.:/usr/java/jdk1.6.0_45/lib/dt.jar:/usr/java/jdk1.6.0_45/lib/tools.jar


  7. PATH=/home/cams/bea/middleware/wlserver_10.3/server/bin:/home/cams/bea/middleware/modules/org.apache.ant_1.7.1/bin:/usr/java/jdk1.6.0_45/jre/bin:/usr/java/jdk1.6.0_45/bin:/usr/java/jdk1.6.0_45/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin::/home/cams/bin


  9. Your environment has been set.

  10. [cams@JJ129077 bin]$ java weblogic.version


  12. WebLogic Server 10.3.6.0  Tue Nov 15 08:52:36 PST 2011 1441050


  14. Use 'weblogic.version -verbose' to get subsystem information


  16. Use 'weblogic.utils.Versions' to get version information for all modules



  19. [cams@JJ129077 zip]$ cd /home/cams/bea/middleware/utils/bsu

  20. [cams@JJ129077 bsu]$ ./bsu.sh -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -status=applied -verbose -view

  21. ProductName: WebLogic Server

  22. ProductVersion: 10.3 MP6

  23. Components: WebLogic Server/Core Application Server,WebLogic Server/Admi

  24.                    nistration Console,WebLogic Server/Configuration Wizard and

  25.                    Upgrade Framework,WebLogic Server/Web 2.0 HTTP Pub-Sub Serve

  26.                    r,WebLogic Server/WebLogic SCA,WebLogic Server/WebLogic JDBC

  27.                     Drivers,WebLogic Server/Third Party JDBC Drivers,WebLogic S

  28.                    erver/WebLogic Server Clients,WebLogic Server/WebLogic Web S

  29.                    erver Plugins,WebLogic Server/UDDI and Xquery Support,WebLog

  30.                    ic Server/Evaluation Database,WebLogic Server/Workshop Code

  31.                    Completion Support

  32. BEAHome: /home/cams/bea/middleware

  33. ProductHome: /home/cams/bea/middleware/wlserver_10.3

  34. PatchSystemDir: /home/cams/bea/middleware/utils/bsu

  35. PatchDir: /home/cams/bea/middleware/patch_wls1036

  36. Profile: Default

  37. DownloadDir: /home/cams/bea/middleware/utils/bsu/cache_dir

  38. JavaVersion: 1.6.0_29

  39. JavaVendor: Sun


  41. 上傳p20780171_1036_Generic.zip和p22248372_1036012_Generic.zip至DownloadDir:/home/cams/bea/middleware/utils/bsu/cache_dir路徑下，并解壓

  42. [cams@JJ129077 cache_dir]$ unzip p20780171_1036_Generic.zip

  43. Archive: p20780171_1036_Generic.zip

  44.  extracting: EJUW.jar

  45.   inflating: patch-catalog_22958.xml

  46.   inflating: README.txt

  47. [cams@JJ129077 cache_dir]$ unzip p22248372_1036012_Generic.zip

  48. Archive: p22248372_1036012_Generic.zip

  49.   inflating: patch-catalog_23501.xml

  50. replace README.txt? [y]es, [n]o, [A]ll, [N]one, [r]ename: r

  51. new name: README1.txt

  52.   inflating: README1.txt

  53.   inflating: ZLNA.jar


  55. 如果不知道如何打補丁，可以參考p20780171_1036_Generic.zip中的README文件，README的內(nèi)容附在文末。 （打補丁之前先把Weblogic停了，最簡單的就是殺進程）

  56. [cams@JJ129077 bsu]$ ./bsu.sh -install -patch_download_dir=/home/cams/bea/middleware/utils/bsu/cache_dir/ -patchlist=EJUW -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -verbose

  57. Exception in thread "main" java.lang.OutOfMemoryError: Java heap space

  58.     at com.bea.plateng.patch.dao.cat.PatchCatalogHelper.getPatchDependencies(PatchCatalogHelper.java:448)

  59.     at com.bea.plateng.patch.dao.cat.PatchCatalogHelper.getPatchDependencies(PatchCatalogHelper.java:464)

  60.     at com.bea.plateng.patch.dao.cat.PatchCatalog.getPatchDependencies(PatchCatalog.java:56)

  61.     at com.bea.plateng.patch.dao.cat.PatchCatalogHelper.getInvalidatedPatchMap(PatchCatalogHelper.java:1621)

  62.     at com.bea.plateng.patch.PatchSystem.updatePatchCatalog(PatchSystem.java:436)

  63.     at com.bea.plateng.patch.PatchSystem.refresh(PatchSystem.java:130)

  64.     at com.bea.plateng.patch.PatchSystem.setCacheDir(PatchSystem.java:201)

  65.     at com.bea.plateng.patch.Patch.main(Patch.java:281)

  66. [cams@JJ129077 bsu]$ ls

  67. bsu.jar  bsu.sh  cache_dir  patch-client.jar  smartupdate.ico

  68. [cams@JJ129077 bsu]$ vi bsu.sh

  69. [cams@JJ129077 bsu]$ cat bsu.sh

  70. #!/bin/sh


  72. JAVA_HOME="/usr/java/jdk1.6.0_45"


  74. MEM_ARGS="-Xms2560m -Xmx5120m"


  76. "$JAVA_HOME/bin/java" ${MEM_ARGS} -jar patch-client.jar $*

  77. [cams@JJ129077 bsu]$ ./bsu.sh -install -patch_download_dir=/home/cams/bea/middleware/utils/bsu/cache_dir/ -patchlist=EJUW -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -verbose

  78. 檢查沖突....

  79. 未檢測到?jīng)_突


  81. 開始安裝補丁程序 ID: EJUW

  82. 安裝 /home/cams/bea/middleware/utils/bsu/cache_dir/EJUW.jar

  83. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/BUG20780171_1036012.jar

  84. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar

  85. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar

  86. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar

  87. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar

  88. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxp_1.4.5.0.jar

  89. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar

  90. 更新 /home/cams/bea/middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar

  91. 舊清單值: Class-Path=

  92. 新清單值: Class-Path=../../../patch_jars/BUG20780171_1036012.jar ../../../patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar ../../../patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar ../../../patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxp_1.4.5.0.jar ../../../patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar

  93. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/webapp/WEB-INF/lib/console.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  94. 備份 /home/cams/bea/middleware/modules/com.bea.core.descriptor.wl.binding_1.4.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  95. 備份 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jstl-1.2.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  96. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-notran-adp.rar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  97. 備份 /home/cams/bea/middleware/wlserver_10.3/common/wlst/modules/jython-modules.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  98. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/APP-INF/lib/commons-fileupload.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  99. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  100. 備份 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls-schema_10.3.6.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  101. 備份 /home/cams/bea/middleware/wlserver_10.3/common/bin/wlsifconfig.sh 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  102. 備份 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-1.2.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  103. 備份 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls_7.2.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  104. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  105. 備份 /home/cams/bea/middleware/modules/glassfish.jstl_1.2.0.1.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  106. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  107. 備份 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-2.0.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  108. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient+ssl.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  109. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/schema/weblogic-domain-binding.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  110. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/jdbcdrivers.xml 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  111. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-xa-adp.rar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  112. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/webapp/WEB-INF/lib/console.jar

  113. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.descriptor.wl.binding_1.4.0.0.jar

  114. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jstl-1.2.war

  115. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-notran-adp.rar

  116. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/common/wlst/modules/jython-modules.jar

  117. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/APP-INF/lib/commons-fileupload.jar

  118. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar

  119. 解壓縮 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls-schema_10.3.6.0.jar

  120. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/APP-INF/lib/commons-io-2.4.jar

  121. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/common/bin/wlsifconfig.sh

  122. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-1.2.war

  123. 解壓縮 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls_7.2.0.0.jar

  124. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.stax2_2.0.0.0_3-0-3.jar

  125. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlclient.jar

  126. 解壓縮 /home/cams/bea/middleware/modules/glassfish.jstl_1.2.0.1.jar

  127. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/bugsfixed/20780171-WLS-10.3.6.0.12_PSU_WebServices-ClientSide-Configuration-README.txt

  128. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.jar

  129. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-2.0.war

  130. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient+ssl.jar

  131. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/bugsfixed/WLS-PSU-bugsfixed.txt

  132. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/schema/weblogic-domain-binding.jar

  133. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/jdbcdrivers.xml

  134. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-xa-adp.rar

  135. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  136. 備份 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  137. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  138. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  139. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  140. 備份 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  141. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  142. 備份 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  143. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  144. 備份 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  145. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  146. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  147. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  148. 備份 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  149. 備份 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  150. 備份 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  151. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  152. 備份 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  153. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar29284.tmp

  154. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar29284.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar

  155. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar44830.tmp

  156. 合并 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar44830.tmp 與 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar

  157. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear31614.tmp

  158. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear31614.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear

  159. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip5321.tmp

  160. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip5321.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip

  161. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war39919.tmp

  162. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war39919.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war

  163. 解壓縮 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar55192.tmp

  164. 合并 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar55192.tmp 與 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar

  165. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar13700.tmp

  166. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar13700.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar

  167. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar38734.tmp

  168. 合并 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar38734.tmp 與 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar

  169. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar20032.tmp

  170. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar20032.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar

  171. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3client.jar16624.tmp

  172. 更新 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3client.jar16624.tmp 到 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3client.jar

  173. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar10325.tmp

  174. 合并 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar10325.tmp 與 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar

  175. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar11487.tmp

  176. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar11487.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar

  177. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar1720.tmp

  178. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar1720.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar

  179. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3jmsclient.jar4576.tmp

  180. 更新 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3jmsclient.jar4576.tmp 到 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3jmsclient.jar

  181. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar51603.tmp

  182. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar51603.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar

  183. 解壓縮 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar5281.tmp

  184. 合并 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar5281.tmp 與 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar

  185. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar34716.tmp

  186. 合并 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar34716.tmp 與 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar

  187. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar59274.tmp

  188. 合并 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar59274.tmp 與 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar

  189. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar57658.tmp

  190. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar57658.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar

  191. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.weblogic.stax_1.11.0.0.jar58675.tmp

  192. 更新 /home/cams/bea/middleware/modules/com.bea.core.weblogic.stax_1.11.0.0.jar58675.tmp 到 /home/cams/bea/middleware/modules/com.bea.core.weblogic.stax_1.11.0.0.jar

  193. 解壓縮 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar23342.tmp

  194. 合并 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar23342.tmp 與 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar

  195. 結(jié)果: 成功


  197. [cams@JJ129077 bsu]$




  201. [cams@JJ129077 bsu]$ ./bsu.sh -install -patch_download_dir=/home/cams/bea/middleware/utils/bsu/cache_dir/ -patchlist=ZLNA -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -verbose

  202. 檢查沖突....

  203. 未檢測到?jīng)_突


  205. 開始安裝補丁程序 ID: ZLNA

  206. 安裝 /home/cams/bea/middleware/utils/bsu/cache_dir/ZLNA.jar

  207. 解壓縮 /home/cams/bea/middleware/patch_wls1036/patch_jars/BUG22248372_1036.jar

  208. 更新 /home/cams/bea/middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar

  209. 舊清單值: Class-Path=../../../patch_jars/BUG20780171_1036012.jar ../../../patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar ../../../patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar ../../../patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxp_1.4.5.0.jar ../../../patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar

  210. 新清單值: Class-Path=../../../patch_jars/BUG22248372_1036.jar ../../../patch_jars/BUG20780171_1036012.jar ../../../patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar ../../../patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar ../../../patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxp_1.4.5.0.jar ../../../patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar

  211. 備份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar

  212. 解壓縮 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar62442.tmp

  213. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar62442.tmp 與 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar

  214. 結(jié)果: 成功


4.查看剛更新的補丁信息

  1. [cams@JJ129077 bsu]$ ./bsu.sh -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -status=applied -verbose -view

  2. ProductName: WebLogic Server

  3. ProductVersion: 10.3 MP6

  4. Components: WebLogic Server/Core Application Server,WebLogic Server/Admi

  5.                    nistration Console,WebLogic Server/Configuration Wizard and

  6.                    Upgrade Framework,WebLogic Server/Web 2.0 HTTP Pub-Sub Serve

  7.                    r,WebLogic Server/WebLogic SCA,WebLogic Server/WebLogic JDBC

  8.                     Drivers,WebLogic Server/Third Party JDBC Drivers,WebLogic S

  9.                    erver/WebLogic Server Clients,WebLogic Server/WebLogic Web S

  10.                    erver Plugins,WebLogic Server/UDDI and Xquery Support,WebLog

  11.                    ic Server/Evaluation Database,WebLogic Server/Workshop Code

  12.                    Completion Support

  13. BEAHome: /home/cams/bea/middleware

  14. ProductHome: /home/cams/bea/middleware/wlserver_10.3

  15. PatchSystemDir: /home/cams/bea/middleware/utils/bsu

  16. PatchDir: /home/cams/bea/middleware/patch_wls1036

  17. Profile: Default

  18. DownloadDir: /home/cams/bea/middleware/utils/bsu/cache_dir

  19. JavaVersion: 1.6.0_29

  20. JavaVendor: Sun



  23. Patch ID: EJUW

  24. PatchContainer: EJUW.jar

  25. Checksum: 1554039558

  26. Severity: optional

  27. Category: General

  28. CR/BUG: 20780171

  29. Restart: true

  30. Description: WLS PATCH SET UPDATE 10.3.6.0.12

  31. WLS PATCH SET UPDATE 10.3.

  32.                    6.0.12


  34. Patch ID: ZLNA

  35. PatchContainer: ZLNA.jar

  36. Checksum: -894774340

  37. Severity: optional

  38. Category: Security

  39. CR/BUG: 22248372

  40. Restart: true

  41. Description: WEBLOGIC SERVER CVE-2015-4852 SECURITY ALERT PATCH (NOV 2015

  42.                    )

  43. WEBLOGIC SERVER CVE-2015-4852 SECURITY ALERT PATCH (NOV 20

  44.                    15)



  47. [cams@JJ129077 bsu]$ java weblogic.version


  49. WebLogic Server Temporary Patch for BUG22248372 Tue Nov 24 00:35:04 MST 2015

  50. WebLogic Server 10.3.6.0.12 PSU Patch for BUG20780171 THU JUN 18 15:54:42 IST 2015

  51. WebLogic Server 10.3.6.0  Tue Nov 15 08:52:36 PST 2011 1441050


  53. Use 'weblogic.version -verbose' to get subsystem information


  55. Use 'weblogic.utils.Versions' to get version information for all modules


5.附錄（README文件：Patch 20780171）

  1. Oracle WebLogic Server Patch Set Update 10.3.6.0.12 README

  2. =========================================================


  4. This README provides information about how to apply Oracle WebLogic Server

  5. Patch Set Update 10.3.6.0.12. It also provides information about reverting to

  6. the original version.


  8. Released: July, 2015



  11. Smart Update Details of Oracle WebLogic Server Patch Set Update 10.3.6.0.12

  12. --------------------------------------------------------------------------


  14. PATCH_ID - EJUW

  15. Patch number - 20780171



  18. Preparing to Install Oracle WebLogic Server Patch Set Update 10.3.6.0.12

  19. -----------------------------------------------------------------------


  21. - WebLogic Server Patch Set Update (PSU) can be applied on a per-domain basis

  22.   (or on a more fine-grained basis), Oracle recommends that PSU be applied on an installation-wide basis.

  23.   PSU applied to a WebLogic Server installation using this recommended practice

  24.   affect all domains and servers sharing that installation.

  25. - Login as same "user" with which the component being patched is installed.

  26. - Stop all WebLogic servers.

  27. - Remove any previously applied WebLogic Server Patch Set Update and associated overlay patches



  30. Installing Oracle WebLogic Server Patch Set Update 10.3.6.0.12

  31. -------------------------------------------------------------


  33.  - unzip p20780171_1036_Generic.zip to {MW_HOME}/utils/bsu/cache_dir or any local directory

  34.    

  35.    Note: You must make sure that the target directory for unzip has required write and executable permissions

  36.          for "user" with which the component being patched is installed.


  38.  - Navigate to the {MW_HOME}/utils/bsu directory.

  39.  - Execute bsu.sh -install -patch_download_dir={MW_HOME}/utils/bsu/cache_dir -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}


  41.    Where, WL_HOME is the path of the WebLogic home


  43.    Reference: BSU Command line interface

  44.               http://docs.oracle.com/cd/E14759_01/doc.32/e14143/commands.htm



  47. Post-Installation Instructions

  48. ------------------------------


  50. a) Restart all WebLogic servers.


  52. b) The following command is a simple way to determine the application of WebLogic Server PSU.


  54.   $ . $WL_HOME/server/bin/setWLSEnv.sh

  55.   $ java weblogic.version


  57. In the following example output, 10.3.6.0.12 is the installed WebLogic Server PSU.


  59.       WebLogic Server 10.3.6.0.12 PSU Patch for BUG20780171



  62. Uninstalling Oracle WebLogic Server Patch Set Update 10.3.6.0.12

  63. ---------------------------------------------------------------


  65.  - Stop all WebLogic Servers

  66.  - Navigate to the {MW_HOME}/utils/bsu directory.

  67.  - Execute bsu.sh -remove -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}



  70. Post-Uninstallation Instructions

  71. --------------------------------


  73. a) Restart all WebLogic Servers.



  76. Oracle recommends that you see following key notes

  77. --------------------------------------------------


  79. - My Oracle Support NOTE: 1306505.1 Announcing Oracle WebLogic Server PSUs (Patch Set Updates)

  80. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1306505.1


  82. - My Oracle Support NOTE: 1470197.1 Master Note on WebLogic Server Patch Set Updates (PSUs)

  83. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1470197.1

  84.  

  85. - My Oracle Support NOTE: 1471192.1 - Replacement Patches for WebLogic Server PSU Conflict Resolution

  86. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1471192.1


  88. - SSL Authentication Problem Using WebLogic 10.3.6 and 12.1.1 With JDK1.7.0_40 or Higher

  89. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1607170.1

  90.  

  91. - Smart Update Applying Patches to Oracle WebLogic Server

  92. http://docs.oracle.com/cd/E14759_01/doc.32/e14143/intro.htm



  95. ==========================================================================

  96. Copyright ?2010, 2011, Oracle and/or its affiliates. All rights reserved.


  98. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.


  100. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.


  102. If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:


  104. U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.


  106. This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.


  108. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.


  110. This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

  111. ==========================================================================

看完了這篇文章，相信你對“Weblogic如何修復"Java反序列化"過程遠程命令執(zhí)行漏洞”有了一定的了解，如果想了解更多相關(guān)知識，歡迎關(guān)注億速云行業(yè)資訊頻道，感謝各位的閱讀！

向AI問一下細節(jié)

免責聲明：本站發(fā)布的內(nèi)容（圖片、視頻和文字）以原創(chuàng)、轉(zhuǎn)載和分享為主，文章觀點不代表本網(wǎng)站立場，如果涉及侵權(quán)請聯(lián)系站長郵箱：is@yisu.com進行舉報，并提供相關(guān)證據(jù)，一經(jīng)查實，將立刻刪除涉嫌侵權(quán)內(nèi)容。

AI
助
手