STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Object permissions granted to PUBLIC must be restricted.

DISA Rule

SV-219709r401224_rule

Vulnerability Number

V-219709

Group Title

SRG-APP-000516-DB-000363

Rule Version

O112-BP-022600

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Revoke any privileges granted to PUBLIC for objects that are not owned by Oracle product accounts.

From SQL*Plus:

revoke [privilege name] from [user name] on [object name];

Assign permissions to custom application user roles based on job functions:

From SQL*Plus:

grant [privilege name] to [user role] on [object name];

Check Contents

Run the SQL query:

select owner ||'.'|| table_name ||':'|| privilege from dba_tab_privs
where grantee = 'PUBLIC'
and owner not in
(<list of non-applicable accounts>);

(With respect to the list of special accounts that are excluded from this requirement, it is expected that the DBA will maintain the list to suit local circumstances, adding special accounts as necessary and removing any that are not supposed to be in use in the Oracle deployment that is under review.)

If any records that are not Oracle product accounts are returned, are not documented and authorized, this is a Finding.

NOTE: This check may return false positives where other Oracle product accounts are not included in the exclusion list.

Vulnerability Number

V-219709

Documentable

False

Rule Version

O112-BP-022600

Severity Override Guidance

Run the SQL query:

select owner ||'.'|| table_name ||':'|| privilege from dba_tab_privs
where grantee = 'PUBLIC'
and owner not in
(<list of non-applicable accounts>);

(With respect to the list of special accounts that are excluded from this requirement, it is expected that the DBA will maintain the list to suit local circumstances, adding special accounts as necessary and removing any that are not supposed to be in use in the Oracle deployment that is under review.)

If any records that are not Oracle product accounts are returned, are not documented and authorized, this is a Finding.

NOTE: This check may return false positives where other Oracle product accounts are not included in the exclusion list.

Check Content Reference

M

Target Key

4057

Comments