STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Oracle application administration roles must be disabled if not required and authorized.

DISA Rule

SV-219712r401224_rule

Vulnerability Number

V-219712

Group Title

SRG-APP-000516-DB-000363

Rule Version

O112-BP-022900

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

For each role assignment returned, issue:

From SQL*Plus:

alter user [username] default role all except [role];

If the user has more than one application administration role assigned, then you will have to remove assigned roles from default assignment and assign individually the appropriate default roles.

Check Contents

Run the SQL query:

select grantee, granted_role from dba_role_privs
where default_role='YES'
and granted_role in
(select grantee from dba_sys_privs where upper(privilege) like '%USER%')
and grantee not in
(<list of non-applicable accounts>)
and grantee not in (select distinct owner from dba_tables)
and grantee not in
(select distinct username from dba_users where upper(account_status) like '%LOCKED%');

(With respect to the list of special accounts that are excluded from this requirement, it is expected that the DBA will maintain the list to suit local circumstances, adding special accounts as necessary and removing any that are not supposed to be in use in the Oracle deployment that is under review.)

Review the list of accounts reported for this check and ensure that they are authorized application administration roles.

If any are not authorized application administration roles, this is a Finding.

Vulnerability Number

V-219712

Documentable

False

Rule Version

O112-BP-022900

Severity Override Guidance

Run the SQL query:

select grantee, granted_role from dba_role_privs
where default_role='YES'
and granted_role in
(select grantee from dba_sys_privs where upper(privilege) like '%USER%')
and grantee not in
(<list of non-applicable accounts>)
and grantee not in (select distinct owner from dba_tables)
and grantee not in
(select distinct username from dba_users where upper(account_status) like '%LOCKED%');

(With respect to the list of special accounts that are excluded from this requirement, it is expected that the DBA will maintain the list to suit local circumstances, adding special accounts as necessary and removing any that are not supposed to be in use in the Oracle deployment that is under review.)

Review the list of accounts reported for this check and ensure that they are authorized application administration roles.

If any are not authorized application administration roles, this is a Finding.

Check Content Reference

M

Target Key

4057

Comments