{"record":{"id":"42b136fecf60521f","repo":"shadow1ng/fscan","slug":"short-oracle-accept-packet","errorCode":null,"errorMessage":"short oracle accept packet","messagePattern":"short oracle accept packet","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":192,"sourceCode":"\tvar p *oraclePacket\n\tfor resends := 0; resends < 3; resends++ {\n\t\tvar err error\n\t\tp, err = s.readPacket()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif p.typ != oraclePacketResend {\n\t\t\tbreak\n\t\t}\n\t\tif err := sendConnect(); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tswitch p.typ {\n\tcase oraclePacketAccept:\n\t\tif len(p.raw) < 40 {\n\t\t\treturn errors.New(\"short oracle accept packet\")\n\t\t}\n\t\ts.version = binary.BigEndian.Uint16(p.raw[8:10])\n\t\ts.negotiatedOptions = binary.BigEndian.Uint16(p.raw[10:12])\n\t\ts.sessionDataUnit = uint32(binary.BigEndian.Uint16(p.raw[12:14]))\n\t\ts.transportDataUnit = uint32(binary.BigEndian.Uint16(p.raw[14:16]))\n\t\tif s.version >= 315 {\n\t\t\ts.sessionDataUnit = binary.BigEndian.Uint32(p.raw[32:36])\n\t\t\ts.transportDataUnit = binary.BigEndian.Uint32(p.raw[36:40])\n\t\t}\n\t\tif s.transportDataUnit < s.sessionDataUnit {\n\t\t\ts.sessionDataUnit = s.transportDataUnit\n\t\t}\n\t\ts.acfl0 = p.raw[22]\n\t\ts.acfl1 = p.raw[23]\n\t\tif s.version >= 315 {\n\t\t\ts.handshakeComplete = true\n\t\t}\n\t\treturn nil","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L174-L210","documentation":"During the Oracle TNS handshake, when the server replies with a Redirect/Accept packet, the client parses fixed fields from the raw packet bytes. If an Accept packet is shorter than the 40 bytes needed to read version, negotiated options, SDU and TDU sizes, the client returns this error instead of reading out of bounds. It means the server's accept packet is malformed or a non-Oracle service answered.","triggerScenarios":"connect() receives a packet with typ == oraclePacketAccept whose raw payload length is < 40, immediately after sending the connect data for oracleRawAuth.","commonSituations":"A proxy/load balancer or honeypot answering the port instead of a real Oracle listener; truncated TCP payload due to a middlebox; wrong port pointing at a non-Oracle service; TNS server version with a shorter packet layout.","solutions":["Verify the target port actually runs an Oracle listener (tnsping / check TNS banner).","Check for proxies, port forwarding, or WAF devices in the path that may truncate or rewrite TNS packets.","Capture the raw packet and compare its length against the expected TNS Accept layout to identify the responder.","If you control the client, log len(p.raw) and a hex dump before failing to aid diagnosis."],"exampleFix":"// before\nif len(p.raw) < 40 {\n    return errors.New(\"short oracle accept packet\")\n}\n// after\nif len(p.raw) < 40 {\n    return fmt.Errorf(\"short oracle accept packet: got %d bytes, need 40 (non-Oracle service or truncated response?)\", len(p.raw))\n}","handlingStrategy":"type-guard","validationCode":"// verify the port speaks TNS before full handshake\nbanner, err := readBannerWithTimeout(conn, 5*time.Second)\nif err != nil || !looksLikeTNS(banner) {\n    return errors.New(\"target does not look like an Oracle TNS listener\")\n}","typeGuard":"func isShortAccept(p oraclePacket) bool {\n    return p.typ == oraclePacketAccept && len(p.raw) < 40\n}","tryCatchPattern":"if err := s.connect(p); err != nil {\n    if strings.Contains(err.Error(), \"short oracle accept packet\") {\n        return fmt.Errorf(\"non-Oracle service or truncating middlebox on %s:%d\", host, port)\n    }\n    return err\n}","preventionTips":["Fingerprint the port before running the raw Oracle client","Bypass or account for proxies/load balancers that rewrite TNS traffic","Set read timeouts so truncated responses fail fast and loudly"],"tags":["oracle","tns","handshake","malformed-packet"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}