 |
 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Note:293737.1 Important: If this Note is printed, be aware that its content may change, as per the Modification History below. CONTENTS 1 INTRODUCTION
Oracle Corporation has released the Oracle Critical Patch Update January 2005 (CPUJan2005) on January 18th, 2005. The products included are Oracle Database Server, Oracle Application Server, Oracle Collaboration Suite, Oracle Enterprise Manager Grid Control, and Oracle E-Business Suite A product Pre-installation Note has been released for each of these product suites at the same time. This Pre-installation Note is focused on the Oracle Database Server. For the other Oracle products included in the CPUJan2005, review the following Pre-Installation Notes: Note 293740.1 Oracle Critical Patch Update January 2005 Pre-Installation Note for Oracle
Collaboration Suite In addition, review the following MetaLink Notes thoroughly for general information related to the Oracle CPU Program, CPUJan2005, or previous Oracle Security Alerts: Note 293953.1 Oracle Critical Patch Update January 2005 Advisory The objective of the Pre-Installation Note is to help you identify the patches you need for your Oracle environment and the sequence to apply them. This document is focused on the Oracle Database Server and the products distributed with it. If you are running other Oracle product, please review the Oracle Critical Patch Update Pre-Installation Note for the other products (listed in Introduction) also before applying any patches. The Oracle Database Server is distributed with the Oracle HTTP Server (OHS) and the Oracle Enterprise Manager (EM). For releases prior to Oracle Database 10g, during the Oracle Database Server installation, the OHS is installed by default unless you specifically chose to deselect it at installation time. From Oracle Database 10g, OHS is distributed on a companion CD and is installed separately. The Enterprise Manager Database Control is installed by default with the Oracle Database Server while the Enterprise Manager Grid Control is installed from the companion CD distributed with the Database Server. See the appropriate CPUJan2005 Release Notes supplied with the patch and the Oracle Critical Patch Update January 2005 Advisory (Note 293953.1) for the list of Oracle Database Server components or modules included. By default, many of the Database Server components are installed, except the Oracle HTTP Server for Oracle Database Server 10g and Oracle Enterprise Manager DB Control (10g and later). You can determine the versions of the products installed by running either the Oracle Universal Installer (and selecting ‘Installed Products’), or by running the following command:
For example, if "Oracle HTTP Server” is included in the output of of the above command or in the Oracle Universal Installer, Oracle HTTP Server is installation. Even if the component is not used in your environment, the fact that the component is installed on the system is enough for the Database Server to be vulnerable. For Oracle Database Server 9i
Release 2 and earlier, the fixes for the Oracle HTTP Server component is
included in the Database Server patch. If this component is installed, you
will need to apply the OHS patch also. The existence of an
"Apache" directories under the Database Server $ORACLE_HOME is an
indication that the Oracle HTTP Server is installed. Before you can determine which database patch to download, make a list of Oracle Database Server versions you have installed in your Oracle environment. The list should include the full version numbers. Then, for each Database Server installation, list whether Oracle HTTP Server was installed. You should also list if any of the components listed in the previous section are installed. If the component is not installed, the component specific post-installation actions as described in the patch readme file can be skipped. However, you cannot select which components to be applied to the Database Server during installation. If some, not all, of the components above are installed, it is important that you apply the Oracle Critical Patch Update January 2005. Once you have gathered the product information and read the documentation related to CPUJan2005, prioritize your business systems in your list based on your business requirements. For example, your business requirements may require systems outside of the firewall to have higher priority than systems inside of the firewall. It is required to have previous Patchsets or database upgrades applied before applying the CPUJan2005 patches. CPU patches are cumulative, which means fixes from previous Oracle Security Alerts are included. The database vulnerabilities addressed by this Critical Patch Update do not affect Oracle Database Client-only installations beyond what was addressed in the Security Alert 68 Update. If you have not installed the Security Alert 68 on the Client-only installations, you must install the Security Alert 68 update or this Critical Patch Update on those installations in order to eliminate the security vulnerabilities described by Security Alert 68. The database fixes included
in Oracle Critical Patch Update January 2005 applicable to the Oracle Database
Server are included in the 9.2.0.6 and 10.1.0.4 patch set. Whenever
possible, Oracle highly recommends that you update to the latest patch set of
your Database Server Release. For Oracle9i Release 2 versions
9.2.0.4 and 9.2.0.5, Oracle recommends that you update your database to 9.2.0.6
(Patch 3948480) then you will only need to apply a patch for the OHS component
if it is installed. 5.1 Oracle HTTP Server The Oracle HTTP Server (OHS) is one of the components included in CPUJan2005, and can contain many sub-components, called modules. A primary module is Oracle's mod_plsql. Whenever you have an Oracle HTTP Server installed (either via a Database Server or Application Server installation), you have mod_plsql installed on the file system, and the PL/SQL Toolkit installed as database objects. For CPUJan2005, both of these needs to be updated. The update to the database objects requires connection to the databases involved by issuing the 'sysobjects' command. Note that the 'sysobjects' portion of the patch only needs to be applied to a single database once, from any of the patches. Installing the 'sysobjects' portion multiple times from different patch is benign, as this will result in reapplying the exact same PL/SQL Toolkit change to the database. Note that this patch does not install an entire new Toolkit, but only adds an additional package, "owa_match". Since this is a new package, all previous functionalities of the Toolkit will remain the same. The readme explains the steps to be performed. For more mod_plsql version information, see Note 188622.1 MOD_PLSQL Version Information for iAS/AS10g. 5.2 Previous Database Server Versions Any Database Server version not listed on the matrix does not mean it is not affected by the vulnerabilities included in CPUJan2005 but rather there is a need to upgrade. Unsupported products and previously obtained versions have not been tested for the presence of the security vulnerabilities included in CPUJan2005, nor patched. These versions must be upgraded, in accordance with section 4.3.3.3 of the Software Error Correction Support Policy Note 209768.1 . In some cases, an upgrade to a latest patchset is all that is required. If you have a version lower than the version specified in the following matrix, you MUST upgrade before applying these patches. The Error Correction Support for 8.1.7 for some platforms ended on 31-DEC-2003 as described in Note 250629.1 Oracle Database 8.1.7 (8i) desupport notice 1 of 2 and no Extended Maintenance Support (EMS) was offered. Therefore CPUJan2005 patches for this product version is not available for these platforms. The Error Correction Support for 9.0.1 ended on 31-DEC-2003 as described in Note 201685.1 Oracle Database 9.0.1 (9i) & 9.0.1.x (9i) desupport notice. However, CPUJan2005 patches for this product version is available for Oracle9i Application Server Release 2 (v.9.0.2) and Oracle Application Server 10g (9.0.4) customers using the 9.0.1.x database as their OracleAS Metadata Repository, and Oracle Collaboration Suite v.9.0.3 and v.9.0.4 customers using the 9.0.1 database for their directory storage. For more information regarding the impact of CPUJan2005 to Application Server and Collaboration Suite, please see Note 293738.1 and Note 293740.1. 5.3 Prerequisites If you have Oracle HTTP
Server (OHS) installed, then follow the steps in this section.
5.4 Ready to Start Applying Patches Below are the tables listing the patches you need for your versions of Oracle Database Server and Oracle HTTP Server. Obtain the patches on MetaLink, unzip each and read all Readme files. If ever needing Oracle Support assistance, please provide the list of your Database Server versions and HTTP Server options. Table 1: Oracle Database Server and Oracle HTTP Server (OHS)
* z/OS V10.1.0.3 will be released with Critical Patch Update January 2005 already incorporated into it. As a result, no separate patch is required. Table
2: Oracle HTTP Server (OHS) for 10g
**
10.1.0.2 and 10.1.0.3 shipped with OHS 9.0.4.0. Apply patch 4005890
if you have not applied the 9.0.4.1 patchset. Apply patch 4005894 if you
have applied the 9.0.4.1 patchset. 6.1. For Database Server 8.1.7.4, while applying the CPUJan2005 patch, you may see a conflict reported with 3973565.
6.2. For IBM AIX platform, during patch installation you my receive the following error:
6.3. For all platforms, 9.2.0.4, 9.2.0.5 or 9.2.0.6, Step 1.b. of the README.txt is not clear:
6.4. For all platforms, 8.1.7.4 MODPLSQL Step 3 of the README.txt is not clear:
6.5. For all platforms, customers who upgraded to 9.2.0.4 from 9.2.0.2 or 9.2.0.3 may encounter a known Opatch error.
6.6. On all AIX platforms, when installing 9.2.0.4, 9.2.0.5, 10.1.0.2 or 10.1.0.3, you may receive the following error:
6.7. For 9.2.0.6, when installing the Oracle Critical Patch Update January 2005, an error may occur indicating that the patch is being installed on a wrong platform.
6.8. For Client-Only installation, when installing the Oracle Critical Patch Update January 2005, the following error occur during the relink phase:
6.9. 10.1.0.2 for some platforms are re-uploaded.
6.10. For Database Server 8.1.7.4, while applying the CPUJan2005 patch, you may see a conflict reported similar to the following:
6.11 For Database Server 9.2.0.4, while installing Oracle Critical Patch Update January 2005 on 9.2.0.4, the following error may occur if Spatial is installed and the ORACLE_HOME was upgraded from 9.2.0.2 or 9.2.0.3:
6.12 While installing Oracle Critical Patch Update January 2005, the following Security Alert 68 Oracle HTTP Server patches may return as a conflict.
Note 263719.1 ALERT: Oracle 10g Release 1 (10.1) Support Status and Alerts
18-JAN-05: Initial release. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 | Copyright (c) 1995,2000 Oracle Corporation. All Rights Reserved. Legal Notices and Terms of Use. |  | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||