Security vulnerability scan detects exposed port 8888 on ora.oc4j resource

SYMPTOMS

[root@rac1 ~]# netstat -tunlp | grep 8888
tcp6       0      0 127.0.0.1:8888          :::*                    LISTEN      3107/java

[root@rac1 ~]# lsof -i :8888
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
java    3107 grid  162u  IPv6  88310      0t0  TCP localhost:ddi-tcp-1 (LISTEN)

[root@rac1 ~]# ps -p 3107 -o pid,cmd
  PID CMD
 3107 /u01/app/11.2.0/grid/jdk/bin/java -server -Xcheck:jni -Xms128M -Xmx384M -Djava.awt.headless=true -Ddisable.checkForUpdate=true -Dstdst

SOLUTION

ora.oc4j resource in 11.2 Clusterware (CRS) is actually for the OC4J container which is used by the QoS (Quality of Service) Management.
This is enabled by default in 11.2.0.2 onwards. If you are not using policy managed databases or Oracle Database QoS Management, you can safely stop/disable OC4J.

[grid@rac1 ~]$ srvctl config oc4j
OC4J is configured to run on port number 23792

[grid@rac1 ~]$ srvctl stop oc4j

[grid@rac1 ~]$ srvctl disable oc4j

[grid@rac1 ~]$ srvctl status oc4j
OC4J is disabled
OC4J is not running