Pete Finnigan's Oracle Security Weblog

A question was asked on my Oracle security forum titled "Critical Patch Update on 8.1.7.4". In this question the poster wanted to know how it can be possible to correctly determine if a CPU or other patch set has been applied to an Oracle database. Or conversely you could ask what patch level is an Oracle database at. Whilst this question as raised against an 8.1.7 database it is relevant for all versions.

There are many ways to find the version of an Oracle database, v$version, dba_registry, listener banner, OPatch, the inventory xml file, the installer actions log and non of which are particularly accurate. The way to do it reliably is to analyze the patches and determine checksums for new or modified pieces of code shipped by Oracle. This technique is explained in some detail in an excellent paper by David Litchfield titled http://www.databasesecurity.com/oracle/oracle-patching.pdf - (broken link) Patch verification of Oracle database servers. This is well worth reading if you want to understand how to reliably check Oracle patch levels.

Why oh why cannot Oracle make it easy for us to determine the patch level and version accurately?