Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Laurent on hidden parameters"] [Next entry: "A good comparison between Oracle and SQL Server features"]

Determining if a patch set has been applied to an Oracle database

A question was asked on my Oracle security forum titled "Critical Patch Update on". In this question the poster wanted to know how it can be possible to correctly determine if a CPU or other patch set has been applied to an Oracle database. Or conversely you could ask what patch level is an Oracle database at. Whilst this question as raised against an 8.1.7 database it is relevant for all versions.

There are many ways to find the version of an Oracle database, v$version, dba_registry, listener banner, OPatch, the inventory xml file, the installer actions log and non of which are particularly accurate. The way to do it reliably is to analyze the patches and determine checksums for new or modified pieces of code shipped by Oracle. This technique is explained in some detail in an excellent paper by David Litchfield titled - (broken link) Patch verification of Oracle database servers. This is well worth reading if you want to understand how to reliably check Oracle patch levels.

Why oh why cannot Oracle make it easy for us to determine the patch level and version accurately?