WUT-121: The file transfer has been forbidden by the Administrator

 

Problem:  Users were not able to download files.

Solution: Edit these files and add below parameters:

$DOMAIN_HOME/config/fmwconfig/components/FORMS/forms1/server/webutil.cfg

$DOMAIN_HOME/config/fmwconfig/components/FORMS/instances/forms1/server/webutil.cfg

transfer.database.enabled=TRUE

transfer.appsrv.enabled=TRUE

transfer.appsrv.workAreadRoot=TRUE

transfer.appsrv.accessControl=TRUE

#List transfer.appsrv.read.<n> directories

transfer.appsrv.read.1=/temp

#transfer.appsrv.read2.=<locatation>

#List transfer.appsrv.write.<n> directories

transfer.appsrv.write.1=/temp

Self-signed TLS/SSL certificate Vulnerability - Weblogic 12.2.1.4

Vulnerability Title: Self-signed TLS/SSL certificate

Service Port:4443

Service Name: HTTPS

Service Protocol: tcp

Vulnerability Description: 

The server's TLS/SSL certificate is self-signed. Self-signed certificates cannot be trusted by default, especially because TLS/SSL man-in-the-middle attacks typically use self-signed certificates to eavesdrop on TLS/SSL connections.

Solution:

Obtain a new TLS/SSL server certificate that is NOT self-signed and install it on the server or remove the demo certificates.

remove these demo.cert and DemoTrust.jks certificates and check:

$MWH/wlserver/server/lib/DemoTrust.jks

$MWH/wlserver/server/lib/demo.cert

Click Jacking Vulnerability - Weblogic 12.2.1.4

Vulnerability Title: Click Jacking

Service Port:4443

Service Name: HTTPS

Service Protocol: tcp

Vulnerability Description: 

Clickjacking, also known as a UI redress attack, is a method in which an attacker uses multiple transparent or opaque layers to trick a user into clicking a button or link on a page other than the one they believe they are clicking. Thus, the attacker is "hijacking" clicks meant for one page and routing the user to an illegitimate page.

Vulnerability Solution:Use HTTP X-Frame-Options. Send the HTTP response headers with X-Frame-Options that instruct the browser to restrict framing where it is not allowed.

 

1. Apply the Patch 30418565

 Patch 30418565 FORMS LISTENER SERVLET NOT GENERATING X-FRAME-OPTIONS HTTP HEADER

 

Add SAMEORIGIN option with X-Frame-Options optin in Run-time and Staging httpd.conf

--  X-Frame-Options is available at line 1033

Header always append X-Frame-Options SAMEORIGIN

2.Run-time directory:

$DOMAIN_HOME/config/fmwconfig/components/OHS/instances/<componentName>/httpd.conf

3.Staging directory:

$DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf

Restart the service and check.

Browsable Web Directory Vulnerability - Weblogic 12.2.1.4

Vulnerability Title:Browsable web directory 

Service Port:4443

Service Name:HTTPS

Service Protocol:tcp

Vulnerability Description: A web directory was found to be browsable, which means that anyone can see the contents of the directory. These directories can be found: 

 * via page spidering (following hyperlinks), or

 * as part of a parent path (checking each directory along the path and searching for ""Directory Listing"" or similar strings), or

 * by brute forcing a list of common directories.

 Browsable directories could allow an attacker to perform a directory traversal attack by viewing ""hidden"" files in the web root, including CGI scripts, data files, or backup pages."

Vulnerability Proof: https://<*.*,*.*>:4443/OracleHTTPServer12c_files/ 

Solution:

Remove the "Indexs" option from Run-time & Staging httpd.conf 

--check @ line # 241

From: Options Indexes FollowSymLinks

To: Options FollowSymLinks

1.Run-time directory:

$DOMAIN_HOME/config/fmwconfig/components/OHS/instances/<componentName>/httpd.conf

2.Staging directory:

$DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf

You should add the following value in [default] section of the formsweb.cfg

3.$DOMAIN_HOME/config/fmwconfig/servers/WLS_FORMS/applications/formsapp_12.2.1/config/formsweb.cfg

#

#X-Frame-Options to Resolve Click-Jacking

#

Set_X_Frame_Options=true

If you are not planing for https then comment out these lines in both Run-time and Staging httpd.conf files:

# Include the SSL definitions and Virtual Host container

include "ssl.conf"------------------------------->Comment out this.

....

IncludeOptional "moduleconf/*.conf" ------------------------------->Comment out this.

Restart the services and then test.

Weblogic 12.2.1.4 Admin Server Default Port Change

 

Please make the below changes to update the port in FMW 12.2.1.4:

Step 1: Take the backup of the below files:

$DOMAIN_HOME/config/fmwconfig/servers/AdminServer/applications/em/META-INF/emoms.properties

$DOMAIN_HOME/sysman/state/targets.xml

$DOMAIN_HOME/bin/stopManagedWebLogic.sh

$DOMAIN_HOME/bin/startManagedWebLogic.sh

$DOMAIN_HOME/bin/stopWebLogic.sh

Step 2: Navigate to the Weblogic Admin Console > Environments > Servers > AdminServer > Configuration Tab > General Sub Tab > now change the listen port from 7001 to 7010 and save the changes

Step3: Update the Admin Port(7001 to 7010) in the below files:

$DOMAIN_HOME/config/fmwconfig/servers/AdminServer/applications/em/META-INF/emoms.properties

$DOMAIN_HOME/sysman/state/targets.xml

$DOMAIN_HOME/bin/stopManagedWebLogic.sh

$DOMAIN_HOME/bin/startManagedWebLogic.sh

$DOMAIN_HOME/bin/stopWebLogic.sh

Step 4: Run $DOMAIN_HOME/bin/setDomainEnv.sh

Step 5: Restart your Admin Server and test the Weblogic Console URL and EM Console URL.

Admin Server Failure To Start With Error BEA-000362 Server failed

There are 1 nested errors:

weblogic.management.DeploymentException: java.io.IOException: Error from fcntl() for file locking, Resource temporarily unavailable, errno=11

Solution: 

Remove these *.lok file and then try to start

$DOMAIN_HOME/edit.lok

$DOMAIN_HOME/config/lifecycle-config.xml.lok

$DOMAIN_HOME/config/ovd/default/ovd.lok

$DOMAIN_HOME/servers/AdminServer/tmp/AdminServer.lok

$DOMAIN_HOME/servers/WLS_FORMS/tmp/WLS_FORMS.lok

$DOMAIN_HOME/servers/WLS_REPORTS/tmp/WLS_REPORTS.lok

$DOMAIN_HOME/tmp/<filename>.lok

find . -name "*.lok" -exec rm -f {} \;

$DOMAIN_HOME/servers/AdminServer/data/store/default/_WLS_ADMINSERVER000000.DAT

$DOMAIN_HOME/servers/AdminServer/data/store/diagnostics/WLS_DIAGNOSTICS000000.DAT

$DOMAIN_HOME/servers/WLS_FORMS/data/store/default/_WLS_WLS_FORMS000000.DAT

$DOMAIN_HOME/servers/WLS_FORMS/data/store/diagnostics/WLS_DIAGNOSTICS000000.DAT

$DOMAIN_HOME/servers/WLS_REPORTS/data/store/default/_WLS_WLS_REPORTS000000.DAT

$DOMAIN_HOME/servers/WLS_REPORTS/data/store/diagnostics/WLS_DIAGNOSTICS000000.DAT

find . -name "*.DAT" -exec rename '.DAT' '.DAT_OLD' {} \;

REP-110: Unable to open file

REP-110: File  km_ram_0003.rdf cannot be opened.
REP-1070: An error occurred while opening or saving a document.
REP-0110: File km_ram_0003.rdf cannot be opened.

Solution:

Add reports path in following files and then restart report services:

$ORACLE_HOME/bin/reports.sh

$DOMAIN_HOME/reports/bin/reports.sh

REPORTS_PATH=/u01/reports:${ORACLE_HOME}/reports/templates:${ORACLE_HOME}/reports/samples/demo:${ORACLE_HOME}/reports/printers:${DOMAIN_HOME}/reports/fonts:${REPORTS_PATH}; export REPORTS_PATH