STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

System Privileges should not be granted to PUBLIC.

DISA Rule

SV-24931r2_rule

Vulnerability Number

V-2564

Group Title

Oracle system privilege assignment

Rule Version

DO3612-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Revoke any system privileges assigned to PUBLIC:

From SQL*Plus:

revoke [system privilege] from PUBLIC;

Replace [system privilege] with the named system privilege.

NOTE: System privileges are not granted to PUBLIC by default and would indicate a custom action.

Check Contents

From SQL*Plus:

select privilege from dba_sys_privs where grantee = 'PUBLIC';

If any records are returned, this is a Finding.

Vulnerability Number

V-2564

Documentable

False

Rule Version

DO3612-ORACLE11

Severity Override Guidance

From SQL*Plus:

select privilege from dba_sys_privs where grantee = 'PUBLIC';

If any records are returned, this is a Finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1367

Comments