Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Anyone with version fingerprinting tool can know oracle version. So, are there any ways to hide oracle version rather than filtering incoming traffic?

share|improve this question

There's a book called the Oracle Hacker's Handbook that goes into some detail on this. From what I recall, the connection conversation makes it fairly plain which database version/release you are talking to. However it doesn't reveal patches etc, which would be more interesting/useful to a potential infiltrator.

For anyone in the database, it would be simple to test the availability of various functions to determine the major release number. Also features such as conditional compilation rely on being able to supply this information.

share|improve this answer
+1, good info... – DCookie May 4 '10 at 13:11

I'm not sure how useful is that - any hacker will just try the latest exploits, so he will likely succeed taking over you system if you didn't install the latest quarterly security updates (CPUs / PSUs). Anyway, the version information can be retrieved from many places, like listener headers,sqlplus, within a session (select banner from v$version) etc. Each could likely be blocked, but still the hacker will just try a new exploit and if you are not patched, you have lost. I would recommend you to check Oracle Project Lockdown - how to secure your database environment:

share|improve this answer
also the Oracle Hacker's Handbook that Gary recommended is a great book – Ofir Manor May 4 '10 at 12:00
+1, good info... – DCookie May 4 '10 at 13:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.