Oracle TNS Listener VSNNUM Version Remote Information Disclosure

Tenable plugin 110053 fires when an Oracle TNS listener on TCP 1521 answers an unauthenticated VERSION/VSNNUM request and reveals its listener build. The plugin itself does not tie the finding to a specific vulnerable Oracle release, and Oracle documentation shows VERSION is a built-in listener control behavior with no prerequisite password. Practically, any Oracle listener reachable by the scanner and willing to answer that request can trigger this, across many Oracle Database generations and both Linux and Windows listener deployments.

The vendor's MEDIUM label is too generous for enterprise patch scheduling. The finding is unauthenticated and remote, but the impact is only low-grade reconnaissance: it helps attackers fingerprint the stack and choose follow-on tooling, yet it does not itself expose credentials, data, or code execution. In real environments the decisive factor is exposure, not patch level: if the listener is not reachable from untrusted networks, the risk collapses fast.

Why this verdict

• Vendor baseline starts at 5.3, but the impact is only C:L — no integrity, no availability, no execution, no auth bypass.
• Attacker position is unauthenticated remote, but only if the listener is reachable — for most enterprises that implies a misexposed DB service, not broad external reachability.
• This step implies a second-stage dependency — the disclosure only helps choose later exploits or login paths; by itself it does not advance to code execution or data access.

Why not higher?

Because the chain stops at fingerprinting. There is no direct path here to execute code, dump data, or alter the database, and modern defenses that keep DB listeners off untrusted networks erase most of the practical risk. Even when externally reachable, this is still an intelligence leak, not a takeover bug.

Why not lower?

It is still remotely accessible information disclosure, and exact Oracle versioning does reduce attacker uncertainty during targeting. If you have internet-exposed listeners or flat internal networks, this finding does provide usable recon value and should not be dismissed as noise.

1. Restrict listener reachability — Put Oracle listener ports behind firewall allow-lists, private subnets, or VPN-only paths. For a LOW verdict there is no hard SLA, so treat this as backlog hygiene, but close any unnecessary exposure before the next firewall review cycle.
2. Validate Oracle net ACLs — Use Oracle network controls such as listener registration restrictions and valid-node style controls where supported, alongside network ACLs. This reduces who can even talk to the listener; for LOW, schedule as backlog hygiene rather than emergency change work.
3. Watch for listener enumeration — Add lightweight detections for repeated probes to 1521/tcp, especially from non-app subnets, scanning ranges, or internet ingress points. This will not prevent the response, but it gives you signal when someone is mapping Oracle estate.
4. Inventory exposed Oracle listeners — Treat the real problem as exposure management: identify every host with an Oracle listener reachable beyond its intended app tier. For LOW, no emergency SLA applies, but this belongs in normal attack-surface reduction work.

Run this from an auditor workstation or scanner node that has network reachability to the Oracle listener. Invoke it as python3 check_tns_vsnnum.py 10.20.30.40 1521; it needs no privileges beyond the ability to run nmap and connect to the target port. The script reports VULNERABLE if Nmap can retrieve the listener version, PATCHED if the listener does not disclose it, and UNKNOWN if prerequisites are missing.

#!/usr/bin/env python3
# check_tns_vsnnum.py
# Detects whether an Oracle TNS listener discloses VSNNUM/version unauthenticated
# by invoking Nmap's oracle-tns-version NSE script.
# Exit codes:
#   0 = PATCHED / not disclosing
#   1 = VULNERABLE / disclosing
#   2 = UNKNOWN / dependency or runtime issue

import shutil
import subprocess
import sys


def main():
    if len(sys.argv) not in (2, 3):
        print("UNKNOWN - usage: python3 check_tns_vsnnum.py <host> [port]", file=sys.stderr)
        sys.exit(2)

    host = sys.argv[1]
    port = sys.argv[2] if len(sys.argv) == 3 else "1521"

    if shutil.which("nmap") is None:
        print("UNKNOWN - nmap is not installed or not in PATH")
        sys.exit(2)

    cmd = [
        "nmap",
        "-Pn",
        "-n",
        "-p", str(port),
        "--script", "oracle-tns-version",
        host,
    ]

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=90)
    except subprocess.TimeoutExpired:
        print("UNKNOWN - nmap timed out")
        sys.exit(2)
    except Exception as exc:
        print(f"UNKNOWN - failed to run nmap: {exc}")
        sys.exit(2)

    output = (proc.stdout or "") + "\n" + (proc.stderr or "")
    low = output.lower()

    # Positive indicators from the NSE script / service detection output.
    indicators = [
        "oracle-tns-version",
        "vsnnum",
        "tnslsnr for",
        "tns listener",
    ]

    if any(i in low for i in indicators):
        print("VULNERABLE - listener version information was disclosed unauthenticated")
        sys.exit(1)

    if "0 hosts up" in low or "host seems down" in low:
        print("UNKNOWN - host unreachable from this scanner location")
        sys.exit(2)

    if "closed" in low or "filtered" in low:
        print("PATCHED - port not reachable or listener not exposed from this location")
        sys.exit(0)

    print("PATCHED - no unauthenticated listener version disclosure detected")
    sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Tenable plugin 110053
2. Vulners mirror of Tenable NASL
3. Oracle Net Services Reference - LSNRCTL VERSION command
4. Oracle listener administration guide
5. Nmap oracle-tns-version NSE documentation
6. UK Government guidance on open port 1521
7. CISA Known Exploited Vulnerabilities Catalog
8. SC Media reporting on exposed Oracle TNS systems