1

Anyone with version fingerprinting tool can know oracle version. So, are there any ways to hide oracle version rather than filtering incoming traffic?

2

There's a book called the Oracle Hacker's Handbook that goes into some detail on this. From what I recall, the connection conversation makes it fairly plain which database version/release you are talking to. However it doesn't reveal patches etc, which would be more interesting/useful to a potential infiltrator.

For anyone in the database, it would be simple to test the availability of various functions to determine the major release number. Also features such as conditional compilation rely on being able to supply this information.

2

I'm not sure how useful is that - any hacker will just try the latest exploits, so he will likely succeed taking over you system if you didn't install the latest quarterly security updates (CPUs / PSUs). Anyway, the version information can be retrieved from many places, like listener headers,sqlplus, within a session (select banner from v$version) etc. Each could likely be blocked, but still the hacker will just try a new exploit and if you are not patched, you have lost. I would recommend you to check Oracle Project Lockdown - how to secure your database environment

  • also the Oracle Hacker's Handbook that Gary recommended is a great book – Ofir Manor May 4 '10 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy