How to eliminate false-positive alerts for the Possible TNS Poisoning rule

Technical Articles ID: KB76655
Last Modified: 2022-10-14 04:32:39 Etc/GMT

Environment

Database Activity Monitoring (DAM) 4.x

Summary

The rule, Possible TNS Poisoning, is intended to detect the TNS Poison Attacks against Oracle databases (CVE-2012-1675). Sometimes, the rule might generate false-positive alerts when a remote listener registration takes place. This article helps eliminate such false-positive alerts.

Problem

False-positive alerts for the rule Possible TNS Poisoning are incorrectly generated.

Cause

The Possible TNS Poisoning rule often generates false-positive alerts during remote listener registrations, especially in Real Application Cluster environments.

Solution

We recommend that you create a vPatch exception to exclude the legitimate listener registrations.

To add an exception to the Possible TNS Poisoning rule:

Log on to the Database Security console.
Click the Rules tab.
Locate rule 300 (Possible TNS Poisoning; ID:300) under the System ID column and click the Properties icon.
Click Add Exception under one or more Exceptions sections.
Exclude either the IP address, Host Name, or Application as needed, and then click Save.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

How to eliminate false-positive alerts for the Possible TNS Poisoning rule

Environment

Summary

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

How to eliminate false-positive alerts for the Possible TNS Poisoning rule

Environment

Summary

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title