STIGQter STIGQter: STIG Summary: EDB Postgres Advanced Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The EDB Postgres Advanced Server and associated applications must reserve the use of dynamic code execution for situations that require it.

DISA Rule

SV-213609r508024_rule

Vulnerability Number

V-213609

Group Title

SRG-APP-000251-DB-000391

Rule Version

PPS9-00-006300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Install and configure SQL/Protect as documented here:

http://www.enterprisedb.com/docs/en/9.5/eeguide/Postgres_Plus_Enterprise_Edition_Guide.1.072.html#

Alternatively, implement, document, and maintain another method of checking for the validity of inputs.

Check Contents

Execute the following SQL as enterprisedb:

SELECT * FROM sqlprotect.list_protected_users;

If the database and user that handles user input is not listed or if sqlprotect.list_protected_users does not exist (meaning SQL/Protect is not installed), and an alternative means of reviewing for vulnerable code is not in use, this is a finding.

Vulnerability Number

V-213609

Documentable

False

Rule Version

PPS9-00-006300

Severity Override Guidance

Execute the following SQL as enterprisedb:

SELECT * FROM sqlprotect.list_protected_users;

If the database and user that handles user input is not listed or if sqlprotect.list_protected_users does not exist (meaning SQL/Protect is not installed), and an alternative means of reviewing for vulnerable code is not in use, this is a finding.

Check Content Reference

M

Target Key

3988

Comments