STIGQter STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

Audit records should be restricted to authorized individuals.

DISA Rule

SV-24622r2_rule

Vulnerability Number

V-5686

Group Title

DBMS audit record access

Rule Version

DG0032-ORACLE11

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Document and authorize accounts granted access to the AUD$ table in the System Security Plan.

Revoke access permissions granted to the AUD$ table from unauthorized users.

Check Contents

From SQL*Plus:
select value from v$parameter where name='audit_trail';

If none of the following values is displayed, this check is Not a Finding.

Oracle 11.1 – 11.2 = 'db'
Oracle 11.1 – 11.2 = 'db_extended'

Review access granted to the AUD$ table.

From SQL*Plus:
select grantee from dba_tab_privs
where table_name = 'AUD$'
and grantee not in ('DELETE_CATALOG_ROLE')
and grantee not in
(select grantee from dba_role_privs
where granted_role = 'DBA')
order by grantee;

View access granted to the AUD$ table against those authorized in the System Security Plan.

If any are not authorized, this is a Finding.

Vulnerability Number

V-5686

Documentable

True

Rule Version

DG0032-ORACLE11

Severity Override Guidance

From SQL*Plus:
select value from v$parameter where name='audit_trail';

If none of the following values is displayed, this check is Not a Finding.

Oracle 11.1 – 11.2 = 'db'
Oracle 11.1 – 11.2 = 'db_extended'

Review access granted to the AUD$ table.

From SQL*Plus:
select grantee from dba_tab_privs
where table_name = 'AUD$'
and grantee not in ('DELETE_CATALOG_ROLE')
and grantee not in
(select grantee from dba_role_privs
where granted_role = 'DBA')
order by grantee;

View access granted to the AUD$ table against those authorized in the System Security Plan.

If any are not authorized, this is a Finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1367

Comments