STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the MySQL Database Server 8.0, etc.) must be restricted to authorized users.

DISA Rule

SV-235166r638812_rule

Vulnerability Number

V-235166

Group Title

SRG-APP-000133-DB-000362

Rule Version

MYS8-00-008700

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Assign ownership of authorized objects to authorized object owner accounts.

Review user accounts with the GRANT OPTION.

REVOKE GRANT OPTION to limit users with grant privileges.

Check Contents

MySQL database objects do not have an owner. MySQL is a single instance and single database with multiple schemas (aliased to be called either schema or database). Permissions are based on schemas and schema objects and privileges include grants to objects or grants to allow users to further grants access to objects. To reiterate, there is not an object owner just rights assigned to schemas and the objects within them.

To determine rights to objects via schema, table, or user privileges run the following:
SELECT * FROM `information_schema`.`SCHEMA_PRIVILEGES`;
SELECT * FROM `information_schema`.`TABLE_PRIVILEGES`;
SELECT * FROM `information_schema`.`COLUMN_PRIVILEGES`;
SELECT * FROM `information_schema`.`USER_PRIVILEGES`;
SELECT * FROM `information_schema`.`ROLE_COLUMN_GRANTS`;
SELECT * FROM `information_schema`.`ROLE_TABLE_GRANTS`;

On a per-user basis, for example:
show grants for 'test'@'%';

If any database objects are found to have access by users not authorized to the database objects, this is a finding.

Vulnerability Number

V-235166

Documentable

False

Rule Version

MYS8-00-008700

Severity Override Guidance

MySQL database objects do not have an owner. MySQL is a single instance and single database with multiple schemas (aliased to be called either schema or database). Permissions are based on schemas and schema objects and privileges include grants to objects or grants to allow users to further grants access to objects. To reiterate, there is not an object owner just rights assigned to schemas and the objects within them.

To determine rights to objects via schema, table, or user privileges run the following:
SELECT * FROM `information_schema`.`SCHEMA_PRIVILEGES`;
SELECT * FROM `information_schema`.`TABLE_PRIVILEGES`;
SELECT * FROM `information_schema`.`COLUMN_PRIVILEGES`;
SELECT * FROM `information_schema`.`USER_PRIVILEGES`;
SELECT * FROM `information_schema`.`ROLE_COLUMN_GRANTS`;
SELECT * FROM `information_schema`.`ROLE_TABLE_GRANTS`;

On a per-user basis, for example:
show grants for 'test'@'%';

If any database objects are found to have access by users not authorized to the database objects, this is a finding.

Check Content Reference

M

Target Key

5277

Comments