STIGQter STIGQter: STIG Summary: Oracle Database 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The DBMS must enforce Discretionary Access Control (DAC) policy allowing users to specify and control sharing by named individuals, groups of individuals, or by both, limiting propagation of access rights and including or excluding access to the granularity of a single user.

DISA Rule

SV-237703r667141_rule

Vulnerability Number

V-237703

Group Title

SRG-APP-000328-DB-000301

Rule Version

O121-C2-003000

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Modify DBMS settings to allow users to assign or revoke access rights to objects and information owned by the user. The ability to grant or revoke rights must include the ability to grant or revoke those rights down to the granularity of a single user.

(Note: In most cases, no fix will be necessary. This is default functionality for Oracle.)

Check Contents

Check DBMS settings to determine if users are able to assign and revoke rights to the objects and information that they own. If users cannot assign or revoke rights to the objects and information that they own to groups, roles, or individual users, this is a finding.

Vulnerability Number

V-237703

Documentable

False

Rule Version

O121-C2-003000

Severity Override Guidance

Check DBMS settings to determine if users are able to assign and revoke rights to the objects and information that they own. If users cannot assign or revoke rights to the objects and information that they own to groups, roles, or individual users, this is a finding.

Check Content Reference

M

Target Key

4059

Comments