STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

ccess to external objects should be disabled if not required and authorized.

DISA Rule

SV-24694r1_rule

Vulnerability Number

V-15617

Group Title

DBMS access to external local objects

Rule Version

DG0098-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Where its use is authorized, restrict access by a database session to external host files.

From SQL*Plus:
alter system set utl_file_dir=[authorized directory] scope=spfile;

Replace [authorized directory] with the directory path where file access and storage is authorized.

Review Oracle MetaLink Note 39037.1 if you need to define multiple authorized directories.

The above SQL*Plus command will set the parameter to take effect at next system startup.

Check Contents

From SQL*Plus:
select value from v$parameter where name='utl_file_dir';

If the returned value contains '*', this is a Finding.

Vulnerability Number

V-15617

Documentable

False

Rule Version

DG0098-ORACLE11

Severity Override Guidance

From SQL*Plus:
select value from v$parameter where name='utl_file_dir';

If the returned value contains '*', this is a Finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1367

Comments