STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

Oracle instance names should not contain Oracle version numbers.

DISA Rule

SV-24865r1_rule

Vulnerability Number

V-2517

Group Title

Oracle instance names

Rule Version

DO0220-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Follow the instructions in Oracle MetaLink Note 15390.1 (and related documents) to change the SID for the database without re-creating the database to a value that does not identify the Oracle version.

Check Contents

From SQL*Plus:

select instance_name from v$instance;
select version from v$instance;

If the instance name returned references the Oracle release number, this is a Finding.

Numbers used that include version numbers by coincidence are not a Finding.

The DBA should be able to relate the significance of the presence of a digit in the SID.

Vulnerability Number

V-2517

Documentable

False

Rule Version

DO0220-ORACLE11

Severity Override Guidance

From SQL*Plus:

select instance_name from v$instance;
select version from v$instance;

If the instance name returned references the Oracle release number, this is a Finding.

Numbers used that include version numbers by coincidence are not a Finding.

The DBA should be able to relate the significance of the presence of a digit in the SID.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1367

Comments