{"record":{"id":"c2be799f24ba6a37","repo":"shadow1ng/fscan","slug":"unsupported-oracle-server-protocol-version","errorCode":null,"errorMessage":"unsupported oracle server protocol version","messagePattern":"unsupported oracle server protocol version","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":976,"sourceCode":"\ts.reset()\n\ts.putBytes(1, 6, 0)\n\ts.putBytes([]byte(\"OracleClientGo\\x00\")...)\n\tif err := s.writeData(); err != nil {\n\t\treturn nil, err\n\t}\n\tmsg, err := s.getByte()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif msg != 1 {\n\t\treturn nil, fmt.Errorf(\"oracle protocol negotiation expected message 1, got %d\", msg)\n\t}\n\tproto, err := s.getByte()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif proto != 4 && proto != 5 && proto != 6 {\n\t\treturn nil, errors.New(\"unsupported oracle server protocol version\")\n\t}\n\tif _, err = s.getByte(); err != nil {\n\t\treturn nil, err\n\t}\n\tif _, err = s.getNullTermString(50); err != nil {\n\t\treturn nil, err\n\t}\n\tserverCharset, err := s.getInt(2, false, false)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tserverFlags, err := s.getByte()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tcharsetElem, err := s.getInt(2, false, false)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":958,"sourceCodeEnd":994,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L958-L994","documentation":"After sending the connect (SDU/protocol) request, the server replies with its native protocol version byte. This library only implements versions 4, 5 and 6 of the Oracle Net handshake; any other value means the speaking peer is incompatible and the client aborts before authentication.","triggerScenarios":"protocolNegotiation() reads the version byte via s.getByte() during oracleRawAuth and it is not 4, 5 or 6 (e.g. 0xff rejection marker or an unexpected version).","commonSituations":"Listener rejecting the connect string (returns an error marker instead of a version byte); connecting through the wrong port (e.g. a non-Oracle service); extremely old/new server whose initial version byte differs.","solutions":["Verify the DSN host/port targets the Oracle TNS listener (tnsping-style check), not another service","Check the listener log and connect string (SERVICE_NAME/SID) for rejection causes that make the server return an error byte","Confirm the target Oracle server version is one the plugin supports (protocol 4-6)","If behind a proxy, ensure it passes TNS traffic unmodified"],"exampleFix":"// before\nif proto != 4 && proto != 5 && proto != 6 {\n\treturn nil, errors.New(\"unsupported oracle server protocol version\")\n}\n// after\nif proto != 4 && proto != 5 && proto != 6 {\n\treturn nil, fmt.Errorf(\"unsupported oracle server protocol version: %d\", proto)\n}","handlingStrategy":"validation","validationCode":"// verify the endpoint is an Oracle listener before auth\nconn, err := net.DialTimeout(\"tcp\", host+\":\"+port, 5*time.Second)\nif err != nil { return err }\n// wrong service usually returns a non-4/5/6 version byte immediately\nconn.Close()","typeGuard":"func isSupportedProtocolVersion(b byte) bool { return b == 4 || b == 5 || b == 6 }","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unsupported oracle server protocol version\") {\n\treturn fmt.Errorf(\"check DSN host/port points to an Oracle TNS listener and server version is supported: %w\", err)\n}","preventionTips":["Confirm DSN points at the Oracle listener port (tnsping-style check)","Confirm server version is within the plugin's supported range","Bypass proxies when diagnosing version-byte rejections"],"tags":["oracle","protocol","version","handshake"],"backgroundTag":"incompatible-source-type","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}