{"record":{"id":"5923520c6bc2e686","repo":"shadow1ng/fscan","slug":"unsupported-oracle-verifier-type-d","errorCode":null,"errorMessage":"unsupported oracle verifier type %d","messagePattern":"unsupported oracle verifier type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":1370,"sourceCode":"\t\tsalt, err := hex.DecodeString(auth.salt)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\th := sha1.New()\n\t\t_, _ = h.Write(append([]byte(password), salt...))\n\t\tkey = append(h.Sum(nil), 0, 0, 0, 0)\n\tcase 18453:\n\t\tsalt, err := hex.DecodeString(auth.salt)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tmessage := append(salt, []byte(\"AUTH_PBKDF2_SPEEDY_KEY\")...)\n\t\tspeedyKey = oracleGenerateSpeedyKey(message, []byte(password), auth.pbkdf2VgenCount)\n\t\th := sha512.New()\n\t\t_, _ = h.Write(append(speedyKey, salt...))\n\t\tkey = h.Sum(nil)[:32]\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported oracle verifier type %d\", auth.verifierType)\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tauth.serverSessKey, err = oracleDecryptSessionKey(padding, key, auth.eServerSessKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tauth.clientSessKey = make([]byte, len(auth.serverSessKey))\n\tfor {\n\t\tif _, err = rand.Read(auth.clientSessKey); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif !bytes.Equal(auth.clientSessKey, auth.serverSessKey) {\n\t\t\tbreak\n\t\t}\n\t}\n\tauth.eClientSessKey, err = oracleEncryptSessionKey(padding, key, auth.clientSessKey)","sourceCodeStart":1352,"sourceCodeEnd":1388,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L1352-L1388","documentation":"After receiving the server's authentication response, the library derives the session key from the stored password verifier. The verifier type recorded in the auth response has a variant the library does not implement (only the implemented 11g/12c verifier schemes are supported), so it fails with the numeric verifier type.","triggerScenarios":"The O5LOGON response's verifierType field is a value outside the implemented switch cases (e.g. a 12C verifier variant or a future/patched scheme), hitting the default branch during password-based session key derivation.","commonSituations":"Connecting to a database using newer password verifier generation (e.g. 12c verifiers with PBKDF2 variants configured via SEC_CASE_SENSITIVE_LOGON / sqlnet.allowed_logon_version settings) that the library doesn't handle; patched server with custom verifier.","solutions":["Check the server's password verifier version (DBA_USERS.PASSWORD_VERSIONS) and align it with what the library supports (e.g. 11G/12C variants it implements).","Re-create the user account with a supported verifier: ALTER USER ... identified by ... after adjusting SEC_CASE_SENSITIVE_LOGON / sqlnet.allowed_logon_version_client.","Upgrade the library to a version supporting the newer verifier, or use godror/ODPI-C for 12C+ exclusive verifier setups."],"exampleFix":"-- before: account only has 12C-exclusive verifier the lib can't use\nALTER SYSTEM SET SEC_CASE_SENSITIVE_LOGON=TRUE;\n-- after: allow a verifier generation the library supports\nALTER USER app_user IDENTIFIED BY \"NewPassword\"; -- regenerated with supported verifier\nALTER SYSTEM SET SQLNET.ALLOWED_LOGON_VERSION_SERVER=11;","handlingStrategy":"validation","validationCode":"-- Verify the account's verifier is one the library supports:\n-- SELECT username, password_versions FROM dba_users WHERE username = 'APP_USER';\n-- Prefer accounts with 10G/11G verifiers or configure SQLNET.ALLOWED_LOGON_VERSION_SERVER accordingly.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check DBA_USERS.PASSWORD_VERSIONS before onboarding accounts to this library","Set SQLNET.ALLOWED_LOGON_VERSION_SERVER=11 to allow supported verifier generations","Upgrade the library before raising password verifier requirements server-wide"],"tags":["oracle","authentication","verifier","unsupported-feature"],"backgroundTag":"unsupported-enum-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}