STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

Only authorized system accounts should have the SYSTEM tablespace specified as the default tablespace.

DISA Rule

SV-24856r4_rule

Vulnerability Number

V-3846

Group Title

Oracle default tablespace assignment

Rule Version

DO0155-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Create and dedicate tablespaces to support only one application.

Do not share tablespaces between applications.

Do not grant quotas to application object owners on tablespaces not dedicated to their associated application.

Run the queries:

alter database default tablespace <tablespace_name>;
alter database default temporary tablespace <temporary_tablespace_name>;

alter user <username> default tablespace <tablespace_name> temporary tablespace <temporary_tablespace_name>;

Replace <username> with the named user account.
Replace <tablespace_name> with the new default tablespace name.
Replace <temporary_tablespace_name> with the new default temporary tablespace name (typically TEMP).
Repeat the "alter user" for each affected user account.

Check Contents

Run the query:
select property_name, property_value
from database_properties
where property_name in
('DEFAULT_PERMANENT_TABLESPACE','DEFAULT_TEMP_TABLESPACE');

If either value is set to "SYSTEM", this is a finding.

Run the query:
select username from dba_users
where (default_tablespace = 'SYSTEM' or temporary_tablespace = 'SYSTEM')
and username not in
('LBACSYS','OUTLN','SYS','SYSTEM', 'MGMT_VIEW');

If any non-default account records are returned, this is a finding.

Vulnerability Number

V-3846

Documentable

False

Rule Version

DO0155-ORACLE11

Severity Override Guidance

Run the query:
select property_name, property_value
from database_properties
where property_name in
('DEFAULT_PERMANENT_TABLESPACE','DEFAULT_TEMP_TABLESPACE');

If either value is set to "SYSTEM", this is a finding.

Run the query:
select username from dba_users
where (default_tablespace = 'SYSTEM' or temporary_tablespace = 'SYSTEM')
and username not in
('LBACSYS','OUTLN','SYS','SYSTEM', 'MGMT_VIEW');

If any non-default account records are returned, this is a finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1367

Comments