STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Use of external executables must be authorized.

DISA Rule

SV-219771r395853_rule

Vulnerability Number

V-219771

Group Title

SRG-APP-000141-DB-000093

Rule Version

O112-C2-011800

Severity

CAT II

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

Disable use of or remove any external application executable object definitions that are not authorized.

Disable access to operating system commands from within the DBMS, or document the need for this capability.

Check Contents

Review the database for definitions of application executable objects stored external to the database.

Determine if there are methods to disable use or access, or to remove definitions for external executable objects.

Verify any application executable objects listed are authorized by the ISSO.

If any are not, this is a finding.
If the external executables or libraries are owned by ''SYS'' this is not a finding.


To check for external procedures, execute the following query, which will provide the libraries containing external procedures, the owners of those libraries, users that have been granted access to those libraries, and the privileges they have been granted. If there are owners other than the owners that Oracle provides, there may be executable objects stored either in the database or external to the database that are called by objects in the database. Check to see that those owners are authorized to access those libraries. If there are users that have been granted access to libraries provided by Oracle, check to see that they are authorized to access those libraries.

(connect as sysdba)
set linesize 130
column library_name format a25
column name format a15
column owner format a15
column grantee format a15
column privilege format a15
select library_name,owner, '' grantee, '' privilege
from dba_libraries where file_spec is not null
minus
(
select library_name,o.name owner, '' grantee, '' privilege
from dba_libraries l,
sys.user$ o,
sys.user$ ge,
sys.obj$ obj,
sys.objauth$ oa
where l.owner=o.name
and obj.owner#=o.user#
and obj.name=l.library_name
and oa.obj#=obj.obj#
and ge.user#=oa.grantee#
and l.file_spec is not null
)
union all
select library_name,o.name owner, --obj.obj#,oa.privilege#,
ge.name grantee,
tpm.name privilege
from dba_libraries l,
sys.user$ o,
sys.user$ ge,
sys.obj$ obj,
sys.objauth$ oa,
sys.table_privilege_map tpm
where l.owner=o.name
and obj.owner#=o.user#
and obj.name=l.library_name
and oa.obj#=obj.obj#
and ge.user#=oa.grantee#
and tpm.privilege=oa.privilege#
and l.file_spec is not null
/

Vulnerability Number

V-219771

Documentable

False

Rule Version

O112-C2-011800

Severity Override Guidance

Review the database for definitions of application executable objects stored external to the database.

Determine if there are methods to disable use or access, or to remove definitions for external executable objects.

Verify any application executable objects listed are authorized by the ISSO.

If any are not, this is a finding.
If the external executables or libraries are owned by ''SYS'' this is not a finding.


To check for external procedures, execute the following query, which will provide the libraries containing external procedures, the owners of those libraries, users that have been granted access to those libraries, and the privileges they have been granted. If there are owners other than the owners that Oracle provides, there may be executable objects stored either in the database or external to the database that are called by objects in the database. Check to see that those owners are authorized to access those libraries. If there are users that have been granted access to libraries provided by Oracle, check to see that they are authorized to access those libraries.

(connect as sysdba)
set linesize 130
column library_name format a25
column name format a15
column owner format a15
column grantee format a15
column privilege format a15
select library_name,owner, '' grantee, '' privilege
from dba_libraries where file_spec is not null
minus
(
select library_name,o.name owner, '' grantee, '' privilege
from dba_libraries l,
sys.user$ o,
sys.user$ ge,
sys.obj$ obj,
sys.objauth$ oa
where l.owner=o.name
and obj.owner#=o.user#
and obj.name=l.library_name
and oa.obj#=obj.obj#
and ge.user#=oa.grantee#
and l.file_spec is not null
)
union all
select library_name,o.name owner, --obj.obj#,oa.privilege#,
ge.name grantee,
tpm.name privilege
from dba_libraries l,
sys.user$ o,
sys.user$ ge,
sys.obj$ obj,
sys.objauth$ oa,
sys.table_privilege_map tpm
where l.owner=o.name
and obj.owner#=o.user#
and obj.name=l.library_name
and oa.obj#=obj.obj#
and ge.user#=oa.grantee#
and tpm.privilege=oa.privilege#
and l.file_spec is not null
/

Check Content Reference

M

Target Key

4057

Comments