STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

Unauthorized database links should not be defined and active.

DISA Rule

SV-24389r2_rule

Vulnerability Number

V-3818

Group Title

DBMS links to external databases

Rule Version

DG0075-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Document all remote or external interfaces used by the DBMS to connect to or allow connections from remote or external sources.

Include with the documentation as appropriate, any network ports or protocols, security accounts, and the sensitivity of any data exchanged.

Do not define or configure database links between production databases and test or development databases.

Check Contents

From SQL*Plus:
select db_link||': '||host from dba_db_links;

If no links are returned, this check is Not a Finding.

Review documentation for definitions of authorized database links to external interfaces.

The documentation should include:

- Any remote access to the database
- The purpose or function of the remote connection
- Any access to data or procedures stored externally to the local DBMS
- Any network ports or protocols used by remote connections, whether the remote connection is to a production, test, or development system
- Any security accounts used by DBMS to access remote resources or objects

If any unauthorized database links are defined or the definitions do not match the documentation, this is a Finding.

NOTE: Findings for production-development links under this check are assigned to the production database only.

If any database links are defined between the production database and any test or development databases, this is a Finding.

If remote interface documentation does not exist or is incomplete, this is a Finding.

Vulnerability Number

V-3818

Documentable

True

Rule Version

DG0075-ORACLE11

Severity Override Guidance

From SQL*Plus:
select db_link||': '||host from dba_db_links;

If no links are returned, this check is Not a Finding.

Review documentation for definitions of authorized database links to external interfaces.

The documentation should include:

- Any remote access to the database
- The purpose or function of the remote connection
- Any access to data or procedures stored externally to the local DBMS
- Any network ports or protocols used by remote connections, whether the remote connection is to a production, test, or development system
- Any security accounts used by DBMS to access remote resources or objects

If any unauthorized database links are defined or the definitions do not match the documentation, this is a Finding.

NOTE: Findings for production-development links under this check are assigned to the production database only.

If any database links are defined between the production database and any test or development databases, this is a Finding.

If remote interface documentation does not exist or is incomplete, this is a Finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1367

Comments