STIGQter: STIG Summary: Oracle Database 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Default demonstration and sample databases, database objects, and applications must be removed.

DISA Rule

SV-220284r395853_rule

Vulnerability Number

V-220284

Group Title

SRG-APP-000141-DB-000090

Rule Version

O121-C2-011500

Severity

CAT II

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

Remove any demonstration and sample databases, database applications, objects, and files from the DBMS.

To remove an account and all objects owned by that account (using BI as an example):
DROP USER BI CASCADE;

To remove objects without removing their owner, use the appropriate DROP statement (DROP TABLE, DROP VIEW, etc.).

Check Contents

If Oracle is hosted on a server that does not support production systems, and is designated for the deployment of samples and demonstrations, this is not applicable (NA).

Review documentation and websites from Oracle and any other relevant vendors for vendor-provided demonstration or sample databases, database applications, schemas, objects, and files.

Review the Oracle DBMS to determine if any of the demonstration and sample databases, schemas, database applications, or files are installed in the database or are included with the DBMS application. If any are present in the database or are included with the DBMS application, this is a finding.

The Oracle Default Sample Schema User Accounts are:

BI
Owns the Business Intelligence schema included in the Oracle Sample Schemas.

HR
Manages the Human Resources schema. Schema stores information about the employees and the facilities of the company.

OE
Manages the Order Entry schema. Schema stores product inventories and sales of the company's products through various channels.

PM
Manages the Product Media schema. Schema contains descriptions and detailed information about each product sold by the company.

IX
Manages the Information Exchange schema. Schema manages shipping through business-to-business (B2B) applications database.

SH
Manages the Sales schema. Schema stores statistics to facilitate business decisions.

SCOTT
A demonstration account with a simple schema.

Connect to Oracle as SYSDBA; run the following SQL to check for presence of Oracle Default Sample Schema User Accounts:
select distinct(username) from dba_users where username in
('BI','HR','OE','PM','IX','SH','SCOTT');

If any of the users listed above is returned it means that there are demo programs installed, so this is a finding.

Vulnerability Number

V-220284

Documentable

False

Rule Version

O121-C2-011500

Severity Override Guidance

If Oracle is hosted on a server that does not support production systems, and is designated for the deployment of samples and demonstrations, this is not applicable (NA).

Review documentation and websites from Oracle and any other relevant vendors for vendor-provided demonstration or sample databases, database applications, schemas, objects, and files.

Review the Oracle DBMS to determine if any of the demonstration and sample databases, schemas, database applications, or files are installed in the database or are included with the DBMS application. If any are present in the database or are included with the DBMS application, this is a finding.

The Oracle Default Sample Schema User Accounts are:

BI
Owns the Business Intelligence schema included in the Oracle Sample Schemas.

HR
Manages the Human Resources schema. Schema stores information about the employees and the facilities of the company.

OE
Manages the Order Entry schema. Schema stores product inventories and sales of the company's products through various channels.

PM
Manages the Product Media schema. Schema contains descriptions and detailed information about each product sold by the company.

IX
Manages the Information Exchange schema. Schema manages shipping through business-to-business (B2B) applications database.

SH
Manages the Sales schema. Schema stores statistics to facilitate business decisions.

SCOTT
A demonstration account with a simple schema.

Connect to Oracle as SYSDBA; run the following SQL to check for presence of Oracle Default Sample Schema User Accounts:
select distinct(username) from dba_users where username in
('BI','HR','OE','PM','IX','SH','SCOTT');

If any of the users listed above is returned it means that there are demo programs installed, so this is a finding.

Check Content Reference

M

Target Key

4059

Comments