STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Database objects must be owned by accounts authorized for ownership.

DISA Rule

SV-219767r395850_rule

Vulnerability Number

V-219767

Group Title

SRG-APP-000133-DB-000200

Rule Version

O112-C2-011000

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Update system documentation to include list of accounts authorized for object ownership.

Re-assign ownership of authorized objects to authorized object owner accounts.

Check Contents

Review system documentation to identify accounts authorized to own database objects. Review accounts in DBMS that own objects.

If any database objects are found to be owned by users not authorized to own database objects, this is a finding.


Query the object DBA_OBJECTS to show the users who own objects in the database. The query below will return all of the users who own objects.

sqlplus connect as sysdba

SQL>select owner, object_type, count(*) from dba_objects
group by owner, object_type
order by owner, object_type;

If these owners are not authorized owners, select all of the objects these owners have generated and decide who they should belong to. To make a list of all of the objects, the unauthorized owner has to perform the following query.

SQL>select * from dba_objects where owner =&unauthorized_owner;

Vulnerability Number

V-219767

Documentable

False

Rule Version

O112-C2-011000

Severity Override Guidance

Review system documentation to identify accounts authorized to own database objects. Review accounts in DBMS that own objects.

If any database objects are found to be owned by users not authorized to own database objects, this is a finding.


Query the object DBA_OBJECTS to show the users who own objects in the database. The query below will return all of the users who own objects.

sqlplus connect as sysdba

SQL>select owner, object_type, count(*) from dba_objects
group by owner, object_type
order by owner, object_type;

If these owners are not authorized owners, select all of the objects these owners have generated and decide who they should belong to. To make a list of all of the objects, the unauthorized owner has to perform the following query.

SQL>select * from dba_objects where owner =&unauthorized_owner;

Check Content Reference

M

Target Key

4057

Comments