Weblogic如何修复"Java反序列化"过程远程命令执行漏洞

小编给大家分享一下Weblogic如何修复"Java反序列化"过程远程命令执行漏洞，希望大家阅读完这篇文章之后都有所收获，下面让我们一起去探讨吧！

查找文档说明，在https://support.oracle.com上找到补丁的说明文档如下：

CVE-2015-4852 Patch Availability Document for Oracle WebLogic Server Component of Oracle Fusion Middleware (Doc ID 2075927.1)

APPLIES TO:

Oracle WebLogic Server - Version 10.3.6 to 12.2.1.0.0
Oracle Fusion Middleware
Oracle WebLogic Server - Version 10.3 to 10.3
Information in this document applies to any platform.
This applies to any product deployment using Oracle WebLogic Server

PURPOSE

This document defines minimum releases and patches for the Oracle WebLogic Server component of Oracle Fusion Middleware to address the vulnerability described in the Oracle Security Alert for CVE-2015-4852:  http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html

DETAILS

It is important to read the Oracle Security Alert before reading this document. The table below defines minimum releases and patches for Oracle WebLogic Server.

See also Note 2076338.1 CVE-2015-4852 Mitigation Recommendations for Oracle WebLogic Server Component of Oracle Fusion Middleware

n January 2016 CPU Update:

Beginning January 2016, CVE-2015-4852 fixes are now included in the below Patch Set Update (PSU) releases and higher:

2.1.0.1

1.3.0.6

1.2.0.8

3.6.0.13

n To obtain the latest cumulative PSU, refer to the Critical Patch Update program at http://www.oracle.com/technetwork/topics/security/alerts-086861.html . Review the latest Advisory and click the "Fusion Middleware" link within to obtain the latest cumulative Patch Availability Document.

n Important: If you have a version older than 10.3.6 or 12.1.2, you must upgrade as per the Error Correction Policy: Note 950131.1, "Error Correction Support Dates for Oracle WebLogic Server".

n The initial patching requirements from November 2015 are listed below with patch links for all versions under error correction support:

l Patches are not password protected for versions listed above. Older versions are now expired.

l Due to issues with linking to the standard My Oracle Support patch download page, the above links go to an alternative updates.oracle.com location. If you have firewall rules on your network, you should adjust accordingly for the links to work.

l You may also access these patches by going to the "Patches and Updates" tab, perform a search on the above numbers and select your version.

REFERENCES

NOTE:2076338.1 - CVE-2015-4852 Mitigation Recommendations for Oracle WebLogic Server Component of Oracle Fusion Middleware

NOTE:1074055.1 - Security Vulnerability FAQ for Oracle Database and Fusion Middleware Products

下载补丁，通过原文Required Patches处的链接下载补丁包。我所使用的版本为10.3.6.0，所以需要下载的补丁包为PSU 10.3.6.0.12 (Patch 20780171) + 10.3.6.0.12 Patch 22248372 for CVE-2015-4852

3.执行打补丁操作（注意：不同的环境和本文的路径会有所不同）

1. [cams@JJ129077 dateFiles]$ cd /home/cams/bea/middleware/wlserver_10.3/server/bin/
   

2. [cams@JJ129077 bin]$ ls
   

3. international  setWLSEnv.sh  startNodeManager.sh
   

4. [cams@JJ129077 bin]$ . ./setWLSEnv.sh
   

5. CLASSPATH=/home/cams/bea/middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/home/cams/bea/middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/usr/java/jdk1.6.0_45/lib/tools.jar:/home/cams/bea/middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/home/cams/bea/middleware/wlserver_10.3/server/lib/weblogic.jar:/home/cams/bea/middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/home/cams/bea/middleware/wlserver_10.3/server/lib/webservices.jar:/home/cams/bea/middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/home/cams/bea/middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:.:/usr/java/jdk1.6.0_45/lib/dt.jar:/usr/java/jdk1.6.0_45/lib/tools.jar
   

7. PATH=/home/cams/bea/middleware/wlserver_10.3/server/bin:/home/cams/bea/middleware/modules/org.apache.ant_1.7.1/bin:/usr/java/jdk1.6.0_45/jre/bin:/usr/java/jdk1.6.0_45/bin:/usr/java/jdk1.6.0_45/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin::/home/cams/bin
   

9. Your environment has been set.
   

10. [cams@JJ129077 bin]$ java weblogic.version
    

12. WebLogic Server 10.3.6.0  Tue Nov 15 08:52:36 PST 2011 1441050
    

14. Use 'weblogic.version -verbose' to get subsystem information
    

16. Use 'weblogic.utils.Versions' to get version information for all modules
    

19. [cams@JJ129077 zip]$ cd /home/cams/bea/middleware/utils/bsu
    

20. [cams@JJ129077 bsu]$ ./bsu.sh -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -status=applied -verbose -view
    

21. ProductName: WebLogic Server
    

22. ProductVersion: 10.3 MP6
    

23. Components: WebLogic Server/Core Application Server,WebLogic Server/Admi
    

24.                    nistration Console,WebLogic Server/Configuration Wizard and
    

25.                    Upgrade Framework,WebLogic Server/Web 2.0 HTTP Pub-Sub Serve
    

26.                    r,WebLogic Server/WebLogic SCA,WebLogic Server/WebLogic JDBC
    

27.                     Drivers,WebLogic Server/Third Party JDBC Drivers,WebLogic S
    

28.                    erver/WebLogic Server Clients,WebLogic Server/WebLogic Web S
    

29.                    erver Plugins,WebLogic Server/UDDI and Xquery Support,WebLog
    

30.                    ic Server/Evaluation Database,WebLogic Server/Workshop Code
    

31.                    Completion Support
    

32. BEAHome: /home/cams/bea/middleware
    

33. ProductHome: /home/cams/bea/middleware/wlserver_10.3
    

34. PatchSystemDir: /home/cams/bea/middleware/utils/bsu
    

35. PatchDir: /home/cams/bea/middleware/patch_wls1036
    

36. Profile: Default
    

37. DownloadDir: /home/cams/bea/middleware/utils/bsu/cache_dir
    

38. JavaVersion: 1.6.0_29
    

39. JavaVendor: Sun
    

41. 上传p20780171_1036_Generic.zip和p22248372_1036012_Generic.zip至DownloadDir:/home/cams/bea/middleware/utils/bsu/cache_dir路径下，并解压
    

42. [cams@JJ129077 cache_dir]$ unzip p20780171_1036_Generic.zip
    

43. Archive: p20780171_1036_Generic.zip
    

44.  extracting: EJUW.jar
    

45.   inflating: patch-catalog_22958.xml
    

46.   inflating: README.txt
    

47. [cams@JJ129077 cache_dir]$ unzip p22248372_1036012_Generic.zip
    

48. Archive: p22248372_1036012_Generic.zip
    

49.   inflating: patch-catalog_23501.xml
    

50. replace README.txt? [y]es, [n]o, [A]ll, [N]one, [r]ename: r
    

51. new name: README1.txt
    

52.   inflating: README1.txt
    

53.   inflating: ZLNA.jar
    

55. 如果不知道如何打补丁，可以参考p20780171_1036_Generic.zip中的README文件，README的内容附在文末。 （打补丁之前先把Weblogic停了，最简单的就是杀进程）
    

56. [cams@JJ129077 bsu]$ ./bsu.sh -install -patch_download_dir=/home/cams/bea/middleware/utils/bsu/cache_dir/ -patchlist=EJUW -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -verbose
    

57. Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
    

58.     at com.bea.plateng.patch.dao.cat.PatchCatalogHelper.getPatchDependencies(PatchCatalogHelper.java:448)
    

59.     at com.bea.plateng.patch.dao.cat.PatchCatalogHelper.getPatchDependencies(PatchCatalogHelper.java:464)
    

60.     at com.bea.plateng.patch.dao.cat.PatchCatalog.getPatchDependencies(PatchCatalog.java:56)
    

61.     at com.bea.plateng.patch.dao.cat.PatchCatalogHelper.getInvalidatedPatchMap(PatchCatalogHelper.java:1621)
    

62.     at com.bea.plateng.patch.PatchSystem.updatePatchCatalog(PatchSystem.java:436)
    

63.     at com.bea.plateng.patch.PatchSystem.refresh(PatchSystem.java:130)
    

64.     at com.bea.plateng.patch.PatchSystem.setCacheDir(PatchSystem.java:201)
    

65.     at com.bea.plateng.patch.Patch.main(Patch.java:281)
    

66. [cams@JJ129077 bsu]$ ls
    

67. bsu.jar  bsu.sh  cache_dir  patch-client.jar  smartupdate.ico
    

68. [cams@JJ129077 bsu]$ vi bsu.sh
    

69. [cams@JJ129077 bsu]$ cat bsu.sh
    

70. #!/bin/sh
    

72. JAVA_HOME="/usr/java/jdk1.6.0_45"
    

74. MEM_ARGS="-Xms2560m -Xmx5120m"
    

76. "$JAVA_HOME/bin/java" ${MEM_ARGS} -jar patch-client.jar $*
    

77. [cams@JJ129077 bsu]$ ./bsu.sh -install -patch_download_dir=/home/cams/bea/middleware/utils/bsu/cache_dir/ -patchlist=EJUW -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -verbose
    

78. 检查冲突....
    

79. 未检测到冲突
    

81. 开始安装补丁程序 ID: EJUW
    

82. 安装 /home/cams/bea/middleware/utils/bsu/cache_dir/EJUW.jar
    

83. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/BUG20780171_1036012.jar
    

84. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar
    

85. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar
    

86. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar
    

87. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar
    

88. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxp_1.4.5.0.jar
    

89. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar
    

90. 更新 /home/cams/bea/middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar
    

91. 旧清单值: Class-Path=
    

92. 新清单值: Class-Path=../../../patch_jars/BUG20780171_1036012.jar ../../../patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar ../../../patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar ../../../patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxp_1.4.5.0.jar ../../../patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar
    

93. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/webapp/WEB-INF/lib/console.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
    

94. 备份 /home/cams/bea/middleware/modules/com.bea.core.descriptor.wl.binding_1.4.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
    

95. 备份 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jstl-1.2.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
    

96. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-notran-adp.rar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
    

97. 备份 /home/cams/bea/middleware/wlserver_10.3/common/wlst/modules/jython-modules.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
    

98. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/APP-INF/lib/commons-fileupload.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
    

99. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
    

100. 备份 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls-schema_10.3.6.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

101. 备份 /home/cams/bea/middleware/wlserver_10.3/common/bin/wlsifconfig.sh 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

102. 备份 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-1.2.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

103. 备份 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls_7.2.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

104. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

105. 备份 /home/cams/bea/middleware/modules/glassfish.jstl_1.2.0.1.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

106. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

107. 备份 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-2.0.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

108. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient+ssl.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

109. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/schema/weblogic-domain-binding.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

110. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/jdbcdrivers.xml 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

111. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-xa-adp.rar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

112. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/webapp/WEB-INF/lib/console.jar
     

113. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.descriptor.wl.binding_1.4.0.0.jar
     

114. 解压缩 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jstl-1.2.war
     

115. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-notran-adp.rar
     

116. 解压缩 /home/cams/bea/middleware/wlserver_10.3/common/wlst/modules/jython-modules.jar
     

117. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/APP-INF/lib/commons-fileupload.jar
     

118. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar
     

119. 解压缩 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls-schema_10.3.6.0.jar
     

120. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/consoleapp/APP-INF/lib/commons-io-2.4.jar
     

121. 解压缩 /home/cams/bea/middleware/wlserver_10.3/common/bin/wlsifconfig.sh
     

122. 解压缩 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-1.2.war
     

123. 解压缩 /home/cams/bea/middleware/modules/com.oracle.cie.config-wls_7.2.0.0.jar
     

124. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.stax2_2.0.0.0_3-0-3.jar
     

125. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlclient.jar
     

126. 解压缩 /home/cams/bea/middleware/modules/glassfish.jstl_1.2.0.1.jar
     

127. 解压缩 /home/cams/bea/middleware/wlserver_10.3/bugsfixed/20780171-WLS-10.3.6.0.12_PSU_WebServices-ClientSide-Configuration-README.txt
     

128. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.jar
     

129. 解压缩 /home/cams/bea/middleware/wlserver_10.3/common/deployable-libraries/jsf-2.0.war
     

130. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient+ssl.jar
     

131. 解压缩 /home/cams/bea/middleware/wlserver_10.3/bugsfixed/WLS-PSU-bugsfixed.txt
     

132. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/schema/weblogic-domain-binding.jar
     

133. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/jdbcdrivers.xml
     

134. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/jms-xa-adp.rar
     

135. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

136. 备份 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

137. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

138. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

139. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

140. 备份 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

141. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

142. 备份 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

143. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

144. 备份 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

145. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

146. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

147. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

148. 备份 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

149. 备份 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

150. 备份 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

151. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

152. 备份 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

153. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar29284.tmp
     

154. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar29284.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wls-api.jar
     

155. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar44830.tmp
     

156. 合并 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar44830.tmp 与 /home/cams/bea/middleware/modules/com.bea.core.utils_1.10.0.0.jar
     

157. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear31614.tmp
     

158. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear31614.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlstestclient.ear
     

159. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip5321.tmp
     

160. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip5321.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wseeclient.zip
     

161. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war39919.tmp
     

162. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war39919.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/uddiexplorer.war
     

163. 解压缩 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar55192.tmp
     

164. 合并 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar55192.tmp 与 /home/cams/bea/middleware/modules/ws.databinding_1.3.0.0.jar
     

165. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar13700.tmp
     

166. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar13700.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/webserviceclient.jar
     

167. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar38734.tmp
     

168. 合并 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar38734.tmp 与 /home/cams/bea/middleware/modules/com.bea.core.apache_1.3.0.1.jar
     

169. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar20032.tmp
     

170. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar20032.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsafclient.jar
     

171. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3client.jar16624.tmp
     

172. 更新 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3client.jar16624.tmp 到 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3client.jar
     

173. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar10325.tmp
     

174. 合并 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar10325.tmp 与 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar
     

175. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar11487.tmp
     

176. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar11487.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlw-langx.jar
     

177. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar1720.tmp
     

178. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar1720.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmxclient.jar
     

179. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3jmsclient.jar4576.tmp
     

180. 更新 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3jmsclient.jar4576.tmp 到 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlt3jmsclient.jar
     

181. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar51603.tmp
     

182. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar51603.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlsaft3client.jar
     

183. 解压缩 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar5281.tmp
     

184. 合并 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar5281.tmp 与 /home/cams/bea/middleware/modules/ws.databinding.plugins_1.3.0.0.jar
     

185. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar34716.tmp
     

186. 合并 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar34716.tmp 与 /home/cams/bea/middleware/modules/com.bea.core.utils.full_1.10.0.0.jar
     

187. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar59274.tmp
     

188. 合并 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar59274.tmp 与 /home/cams/bea/middleware/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar
     

189. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar57658.tmp
     

190. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar57658.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wljmsclient.jar
     

191. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.weblogic.stax_1.11.0.0.jar58675.tmp
     

192. 更新 /home/cams/bea/middleware/modules/com.bea.core.weblogic.stax_1.11.0.0.jar58675.tmp 到 /home/cams/bea/middleware/modules/com.bea.core.weblogic.stax_1.11.0.0.jar
     

193. 解压缩 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar23342.tmp
     

194. 合并 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar23342.tmp 与 /home/cams/bea/middleware/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar
     

195. 结果: 成功
     

197. [cams@JJ129077 bsu]$
     

201. [cams@JJ129077 bsu]$ ./bsu.sh -install -patch_download_dir=/home/cams/bea/middleware/utils/bsu/cache_dir/ -patchlist=ZLNA -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -verbose
     

202. 检查冲突....
     

203. 未检测到冲突
     

205. 开始安装补丁程序 ID: ZLNA
     

206. 安装 /home/cams/bea/middleware/utils/bsu/cache_dir/ZLNA.jar
     

207. 解压缩 /home/cams/bea/middleware/patch_wls1036/patch_jars/BUG22248372_1036.jar
     

208. 更新 /home/cams/bea/middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar
     

209. 旧清单值: Class-Path=../../../patch_jars/BUG20780171_1036012.jar ../../../patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar ../../../patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar ../../../patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxp_1.4.5.0.jar ../../../patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar
     

210. 新清单值: Class-Path=../../../patch_jars/BUG22248372_1036.jar ../../../patch_jars/BUG20780171_1036012.jar ../../../patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar ../../../patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar ../../../patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxp_1.4.5.0.jar ../../../patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar
     

211. 备份 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar 至 /home/cams/bea/middleware/patch_wls1036/backup/backup.jar
     

212. 解压缩 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar62442.tmp
     

213. 合并 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar62442.tmp 与 /home/cams/bea/middleware/wlserver_10.3/server/lib/wlthint3client.jar
     

214. 结果: 成功

4.查看刚更新的补丁信息

1. [cams@JJ129077 bsu]$ ./bsu.sh -prod_dir=/home/cams/bea/middleware/wlserver_10.3/ -status=applied -verbose -view
   

2. ProductName: WebLogic Server
   

3. ProductVersion: 10.3 MP6
   

4. Components: WebLogic Server/Core Application Server,WebLogic Server/Admi
   

5.                    nistration Console,WebLogic Server/Configuration Wizard and
   

6.                    Upgrade Framework,WebLogic Server/Web 2.0 HTTP Pub-Sub Serve
   

7.                    r,WebLogic Server/WebLogic SCA,WebLogic Server/WebLogic JDBC
   

8.                     Drivers,WebLogic Server/Third Party JDBC Drivers,WebLogic S
   

9.                    erver/WebLogic Server Clients,WebLogic Server/WebLogic Web S
   

10.                    erver Plugins,WebLogic Server/UDDI and Xquery Support,WebLog
    

11.                    ic Server/Evaluation Database,WebLogic Server/Workshop Code
    

12.                    Completion Support
    

13. BEAHome: /home/cams/bea/middleware
    

14. ProductHome: /home/cams/bea/middleware/wlserver_10.3
    

15. PatchSystemDir: /home/cams/bea/middleware/utils/bsu
    

16. PatchDir: /home/cams/bea/middleware/patch_wls1036
    

17. Profile: Default
    

18. DownloadDir: /home/cams/bea/middleware/utils/bsu/cache_dir
    

19. JavaVersion: 1.6.0_29
    

20. JavaVendor: Sun
    

23. Patch ID: EJUW
    

24. PatchContainer: EJUW.jar
    

25. Checksum: 1554039558
    

26. Severity: optional
    

27. Category: General
    

28. CR/BUG: 20780171
    

29. Restart: true
    

30. Description: WLS PATCH SET UPDATE 10.3.6.0.12
    

31. WLS PATCH SET UPDATE 10.3.
    

32.                    6.0.12
    

34. Patch ID: ZLNA
    

35. PatchContainer: ZLNA.jar
    

36. Checksum: -894774340
    

37. Severity: optional
    

38. Category: Security
    

39. CR/BUG: 22248372
    

40. Restart: true
    

41. Description: WEBLOGIC SERVER CVE-2015-4852 SECURITY ALERT PATCH (NOV 2015
    

42.                    )
    

43. WEBLOGIC SERVER CVE-2015-4852 SECURITY ALERT PATCH (NOV 20
    

44.                    15)
    

47. [cams@JJ129077 bsu]$ java weblogic.version
    

49. WebLogic Server Temporary Patch for BUG22248372 Tue Nov 24 00:35:04 MST 2015
    

50. WebLogic Server 10.3.6.0.12 PSU Patch for BUG20780171 THU JUN 18 15:54:42 IST 2015
    

51. WebLogic Server 10.3.6.0  Tue Nov 15 08:52:36 PST 2011 1441050
    

53. Use 'weblogic.version -verbose' to get subsystem information
    

55. Use 'weblogic.utils.Versions' to get version information for all modules

5.附录（README文件：Patch 20780171）

1. Oracle WebLogic Server Patch Set Update 10.3.6.0.12 README
   

2. =========================================================
   

4. This README provides information about how to apply Oracle WebLogic Server
   

5. Patch Set Update 10.3.6.0.12. It also provides information about reverting to
   

6. the original version.
   

8. Released: July, 2015
   

11. Smart Update Details of Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    

12. --------------------------------------------------------------------------
    

14. PATCH_ID - EJUW
    

15. Patch number - 20780171
    

18. Preparing to Install Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    

19. -----------------------------------------------------------------------
    

21. - WebLogic Server Patch Set Update (PSU) can be applied on a per-domain basis
    

22.   (or on a more fine-grained basis), Oracle recommends that PSU be applied on an installation-wide basis.
    

23.   PSU applied to a WebLogic Server installation using this recommended practice
    

24.   affect all domains and servers sharing that installation.
    

25. - Login as same "user" with which the component being patched is installed.
    

26. - Stop all WebLogic servers.
    

27. - Remove any previously applied WebLogic Server Patch Set Update and associated overlay patches
    

30. Installing Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    

31. -------------------------------------------------------------
    

33.  - unzip p20780171_1036_Generic.zip to {MW_HOME}/utils/bsu/cache_dir or any local directory
    

34.    
    

35.    Note: You must make sure that the target directory for unzip has required write and executable permissions
    

36.          for "user" with which the component being patched is installed.
    

38.  - Navigate to the {MW_HOME}/utils/bsu directory.
    

39.  - Execute bsu.sh -install -patch_download_dir={MW_HOME}/utils/bsu/cache_dir -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}
    

41.    Where, WL_HOME is the path of the WebLogic home
    

43.    Reference: BSU Command line interface
    

44.               http://docs.oracle.com/cd/E14759_01/doc.32/e14143/commands.htm
    

47. Post-Installation Instructions
    

48. ------------------------------
    

50. a) Restart all WebLogic servers.
    

52. b) The following command is a simple way to determine the application of WebLogic Server PSU.
    

54.   $ . $WL_HOME/server/bin/setWLSEnv.sh
    

55.   $ java weblogic.version
    

57. In the following example output, 10.3.6.0.12 is the installed WebLogic Server PSU.
    

59.       WebLogic Server 10.3.6.0.12 PSU Patch for BUG20780171
    

62. Uninstalling Oracle WebLogic Server Patch Set Update 10.3.6.0.12
    

63. ---------------------------------------------------------------
    

65.  - Stop all WebLogic Servers
    

66.  - Navigate to the {MW_HOME}/utils/bsu directory.
    

67.  - Execute bsu.sh -remove -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}
    

70. Post-Uninstallation Instructions
    

71. --------------------------------
    

73. a) Restart all WebLogic Servers.
    

76. Oracle recommends that you see following key notes
    

77. --------------------------------------------------
    

79. - My Oracle Support NOTE: 1306505.1 Announcing Oracle WebLogic Server PSUs (Patch Set Updates)
    

80. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1306505.1
    

82. - My Oracle Support NOTE: 1470197.1 Master Note on WebLogic Server Patch Set Updates (PSUs)
    

83. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1470197.1
    

84.  
    

85. - My Oracle Support NOTE: 1471192.1 - Replacement Patches for WebLogic Server PSU Conflict Resolution
    

86. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1471192.1
    

88. - SSL Authentication Problem Using WebLogic 10.3.6 and 12.1.1 With JDK1.7.0_40 or Higher
    

89. https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1607170.1
    

90.  
    

91. - Smart Update Applying Patches to Oracle WebLogic Server
    

92. http://docs.oracle.com/cd/E14759_01/doc.32/e14143/intro.htm
    

95. ==========================================================================
    

96. Copyright ?2010, 2011, Oracle and/or its affiliates. All rights reserved.
    

98. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.
    

100. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.
     

102. If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:
     

104. U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.
     

106. This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.
     

108. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
     

110. This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.
     

111. ==========================================================================

看完了这篇文章，相信你对“Weblogic如何修复"Java反序列化"过程远程命令执行漏洞”有了一定的了解，如果想了解更多相关知识，欢迎关注编程网行业资讯频道，感谢各位的阅读！