Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Anyone with version fingerprinting tool can know oracle version. So, are there any ways to hide oracle version rather than filtering incoming traffic?

share|improve this question
add comment

2 Answers

There's a book called the Oracle Hacker's Handbook that goes into some detail on this. From what I recall, the connection conversation makes it fairly plain which database version/release you are talking to. However it doesn't reveal patches etc, which would be more interesting/useful to a potential infiltrator.

For anyone in the database, it would be simple to test the availability of various functions to determine the major release number. Also features such as conditional compilation rely on being able to supply this information.

share|improve this answer
    
+1, good info... –  DCookie May 4 '10 at 13:11
add comment

I'm not sure how useful is that - any hacker will just try the latest exploits, so he will likely succeed taking over you system if you didn't install the latest quarterly security updates (CPUs / PSUs). Anyway, the version information can be retrieved from many places, like listener headers,sqlplus, within a session (select banner from v$version) etc. Each could likely be blocked, but still the hacker will just try a new exploit and if you are not patched, you have lost. I would recommend you to check Oracle Project Lockdown - how to secure your database environment: http://www.oracle.com/technology/pub/articles/project_lockdown/index.html

share|improve this answer
    
also the Oracle Hacker's Handbook that Gary recommended is a great book –  Ofir Manor May 4 '10 at 12:00
    
+1, good info... –  DCookie May 4 '10 at 13:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.