STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

The DBA role should not be granted to unauthorized user accounts.

DISA Rule

SV-24549r2_rule

Vulnerability Number

V-2527

Group Title

Oracle DBA role assignment

Rule Version

DO3440-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Authorize and document all DBA role authorizations in the System Security Plan.

Revoke DBA role membership from unauthorized accounts.

Revoke DBA role membership from any accounts assigned to a developer job function on a shared production / development database.

Check Contents

From SQL*Plus (NOTE: The owner list below is a short list of all possible default Oracle accounts):

select grantee from dba_role_privs
where granted_role='DBA'
and grantee not in
('SYS', 'SYSTEM', 'SYSMAN', 'CTXSYS', 'WKSYS');

If any accounts are listed, review against the list of DBA accounts authorized by the IAO in the System Security Plan.

If any accounts are assigned the DBA role and are not authorized by the IAO, this is a Finding.

If any DBA roles are assigned to developer accounts and this is a production database, this is a Finding.

If any DBA roles are assigned to shared accounts, this is a Finding.

Vulnerability Number

V-2527

Documentable

True

Rule Version

DO3440-ORACLE11

Severity Override Guidance

From SQL*Plus (NOTE: The owner list below is a short list of all possible default Oracle accounts):

select grantee from dba_role_privs
where granted_role='DBA'
and grantee not in
('SYS', 'SYSTEM', 'SYSMAN', 'CTXSYS', 'WKSYS');

If any accounts are listed, review against the list of DBA accounts authorized by the IAO in the System Security Plan.

If any accounts are assigned the DBA role and are not authorized by the IAO, this is a Finding.

If any DBA roles are assigned to developer accounts and this is a production database, this is a Finding.

If any DBA roles are assigned to shared accounts, this is a Finding.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

1367

Comments