DG0001-ORACLE11 - Vendor supported software is evaluated and patched against newly found vulnerabilities.

CAT|I

Rule-ID|SV-24339r2_rule

STIG-ID|DG0001-ORACLE11

Vuln-ID|V-5658

DG0003-ORACLE11 - The latest security patches should be installed.

CAT|II

Rule-ID|SV-24342r1_rule

STIG-ID|DG0003-ORACLE11

Vuln-ID|V-5659

DG0005-ORACLE11 - Only necessary privileges to the host system should be granted to DBA OS accounts - 'DBA user group members'

800-53|AC-6

Rule-ID|SV-24346r1_rule

STIG-ID|DG0005-ORACLE11

Vuln-ID|V-6756

DG0005-ORACLE11 - Only necessary privileges to the host system should be granted to DBA OS accounts - 'No dba account is a member of the root group'

DG0005-ORACLE11 - Only necessary privileges to the host system should be granted to DBA OS accounts - 'root is not a member of dba groups'

800-53|AC-6(5)

DG0007-ORACLE11 - The database should be secured in accordance with DoD, vendor and/or commercially accepted practices where applicable.

Rule-ID|SV-30742r1_rule

STIG-ID|DG0007-ORACLE11

Vuln-ID|V-6767

DG0009-ORACLE11 - Access to DBMS software files and directories should not be granted to unauthorized users - '/etc/profile umask < 022'

800-53|AC-3(4)(d)

Rule-ID|SV-24595r1_rule

STIG-ID|DG0009-ORACLE11

Vuln-ID|V-15608

DG0009-ORACLE11 - Access to DBMS software files and directories should not be granted to unauthorized users - 'umask < 0022'

DG0010-ORACLE11 - Database executable and configuration files should be monitored for unauthorized modifications.

CAT|III

Rule-ID|SV-24597r1_rule

STIG-ID|DG0010-ORACLE11

Vuln-ID|V-2420

DG0011-ORACLE11 - Configuration management procedures should be defined and implemented for database software modifications.

Rule-ID|SV-24599r1_rule

STIG-ID|DG0011-ORACLE11

Vuln-ID|V-3726

DG0012-ORACLE11 - Database software directories including DBMS configuration files are stored in dedicated directories separate from the host OS and other applications - 'No unauthorized directories exist in $ORACLE_BASE'

800-53|CM-6b.

Rule-ID|SV-24350r1_rule

STIG-ID|DG0012-ORACLE11

Vuln-ID|V-4754

DG0013-ORACLE11 - Database backup procedures should be defined, documented and implemented.

Rule-ID|SV-30765r1_rule

STIG-ID|DG0013-ORACLE11

Vuln-ID|V-15126

DG0016-ORACLE11 - Unused database components, database application software, and database objects should be removed from the DBMS system.

Rule-ID|SV-24359r2_rule

STIG-ID|DG0016-ORACLE11

Vuln-ID|V-3728

DG0017-ORACLE11 - A production DBMS installation should not coexist on the same DBMS host with other, non-production DBMS installations.

800-53|CM-4(1)

Rule-ID|SV-24606r1_rule

STIG-ID|DG0017-ORACLE11

Vuln-ID|V-3803

DG0019-ORACLE11 - Application software should be owned by a Software Application account.

Rule-ID|SV-24363r1_rule

STIG-ID|DG0019-ORACLE11

Vuln-ID|V-3805

DG0020-ORACLE11 - Backup and recovery procedures should be developed, documented, implemented and periodically tested.

Rule-ID|SV-24608r1_rule

STIG-ID|DG0020-ORACLE11

Vuln-ID|V-15129

DG0021-ORACLE11 - A baseline of database application software should be documented and maintained.

Rule-ID|SV-24610r1_rule

STIG-ID|DG0021-ORACLE11

Vuln-ID|V-3806

DG0025-ORACLE11 - DBMS cryptography must be NIST FIPS 140-2 validated - '$ORACLE_HOME/network/admin/sqlnet.ora SQLNET.SSLFIPS_140 = true'

800-53|SC-13

Rule-ID|SV-55867r1_rule

STIG-ID|DG0025-ORACLE11

Vuln-ID|V-43137

DG0025-ORACLE11 - DBMS cryptography must be NIST FIPS 140-2 validated - '$ORACLE_HOME/network/admin/sqlnet.ora SSL_CIPHER_SUITES is configured'

DG0025-ORACLE11 - DBMS cryptography must be NIST FIPS 140-2 validated.

DG0040-ORACLE11 - The DBMS software installation account should be restricted to authorized users - '$ORACLE_BASE owner, group and permissions are configured'

Rule-ID|SV-24374r2_rule

STIG-ID|DG0040-ORACLE11

Vuln-ID|V-2422

DG0040-ORACLE11 - The DBMS software installation account should be restricted to authorized users - '$ORACLE_HOME owner, group and permissions are configured'

DG0040-ORACLE11 - The DBMS software installation account should be restricted to authorized users - 'Oracle install account is disabled'

800-53|AC-3

DG0041-ORACLE11 - Use of the DBMS installation account should be logged.

Rule-ID|SV-24377r1_rule

STIG-ID|DG0041-ORACLE11

Vuln-ID|V-15110

DG0042-ORACLE11 - Use of the DBMS software installation account should be restricted to DBMS software installation, upgrade and maintenance actions.

Rule-ID|SV-24379r1_rule

STIG-ID|DG0042-ORACLE11

Vuln-ID|V-15111

DG0050-ORACLE11 - Database software, applications and configuration files should be monitored to discover unauthorized changes.

Rule-ID|SV-24383r1_rule

STIG-ID|DG0050-ORACLE11

Vuln-ID|V-2423

DG0052-ORACLE11 - All applications that access the database should be logged in the audit trail.

Rule-ID|SV-24626r1_rule

STIG-ID|DG0052-ORACLE11

Vuln-ID|V-3807

DG0053-ORACLE11 - A single database connection configuration file should not be used to configure all database clients.

Rule-ID|SV-24628r1_rule

STIG-ID|DG0053-ORACLE11

Vuln-ID|V-3809

DG0054-ORACLE11 - The audit logs should be periodically monitored to discover DBMS access using unauthorized applications.

Rule-ID|SV-24630r1_rule

STIG-ID|DG0054-ORACLE11

Vuln-ID|V-15611

DG0063-ORACLE11 - DBMS privileges to restore database data or other DBMS configurations, features, or objects should be restricted to authorized DBMS accounts.

Rule-ID|SV-24635r2_rule

STIG-ID|DG0063-ORACLE11

Vuln-ID|V-15107

DG0064-ORACLE11 - DBMS backup and restoration files should be protected from unauthorized access.

Rule-ID|SV-24637r1_rule

STIG-ID|DG0064-ORACLE11

Vuln-ID|V-15120

DG0066-ORACLE11 - Procedures for establishing temporary passwords that meet DoD password requirements for new accounts should be defined, documented and implemented.

Rule-ID|SV-24639r1_rule

STIG-ID|DG0066-ORACLE11

Vuln-ID|V-3811

DG0067-ORACLE11 - Database account passwords should be stored in encoded or encrypted format whether stored in database objects, external host files, environment variables or any other storage locations.

800-53|IA-5(1)(c)

Rule-ID|SV-24641r1_rule

STIG-ID|DG0067-ORACLE11

Vuln-ID|V-3812

DG0068-ORACLE11 - DBMS tools or applications that echo or require a password entry in clear text should be protected from password display.

Rule-ID|SV-24643r1_rule

STIG-ID|DG0068-ORACLE11

Vuln-ID|V-3813

DG0069-ORACLE11 - Procedures and restrictions for import of production data to development databases should be documented, implemented and followed.

Rule-ID|SV-24645r1_rule

STIG-ID|DG0069-ORACLE11

Vuln-ID|V-15140

DG0083-ORACLE11 - Automated notification of suspicious activity detected in the audit trail should be implemented.

Rule-ID|SV-24670r1_rule

STIG-ID|DG0083-ORACLE11

Vuln-ID|V-15102

DG0086-ORACLE11 - DBA roles should be periodically monitored to detect assignment of unauthorized or excess privileges.

Rule-ID|SV-24675r1_rule

STIG-ID|DG0086-ORACLE11

Vuln-ID|V-15106

DG0088-ORACLE11 - The DBMS should be periodically tested for vulnerability management and IA compliance.

Rule-ID|SV-24678r1_rule

STIG-ID|DG0088-ORACLE11

Vuln-ID|V-15112

DG0090-ORACLE11 - Sensitive information stored in the database should be protected by encryption.

Rule-ID|SV-24397r1_rule

STIG-ID|DG0090-ORACLE11

Vuln-ID|V-15131

DG0092-ORACLE11 - Database data files containing sensitive information should be encrypted.

Rule-ID|SV-24684r1_rule

STIG-ID|DG0092-ORACLE11

Vuln-ID|V-15132

DG0093-ORACLE11 - Remote adminstrative connections to the database should be encrypted - '$ORACLE_HOME/ldap/admin/fips.ora SSLFIPS_140 = true'

Rule-ID|SV-24687r1_rule

STIG-ID|DG0093-ORACLE11

Vuln-ID|V-3825

DG0093-ORACLE11 - Remote adminstrative connections to the database should be encrypted - 'Remote admin connections are encrypted'

800-53|AC-17(2)

DG0095-ORACLE11 - Audit trail data should be reviewed daily or more frequently.

Rule-ID|SV-24405r1_rule

STIG-ID|DG0095-ORACLE11

Vuln-ID|V-3827

DG0096-ORACLE11 - The DBMS IA policies and procedures should be reviewed annually or more frequently.

Rule-ID|SV-24689r1_rule

STIG-ID|DG0096-ORACLE11

Vuln-ID|V-15138

DG0097-ORACLE11 - Plans and procedures for testing DBMS installations, upgrades and patches should be defined and followed prior to production implementation.

Rule-ID|SV-24691r1_rule

STIG-ID|DG0097-ORACLE11

Vuln-ID|V-15139

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/bin/extproc does not exist'

800-53|CM-7b.

Rule-ID|SV-24698r1_rule

STIG-ID|DG0099-ORACLE11

Vuln-ID|V-15618

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/network/admin/listener.ora PROGRAM=EXTPROC does not exist'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/network/admin/tnsnames.ora EXTPROC PROTOCOL=IPC'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/network/admin/tnsnames.ora KEY=EXTPROC does not exist'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/rdbms/admin/externaljob.ora run_group = nobody'

800-53|CM-7(2)

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/rdbms/admin/externaljob.ora run_user = nobody'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/rdbms/admin/externaljob.ora SET EXTPROC_DLLS path'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '$ORACLE_HOME/rdbms/admin/externaljob.ora SET EXTPROC_DLLS=ONLY'

DG0101-ORACLE11 - OS accounts used to execute external procedures should be assigned minimum privileges.

Rule-ID|SV-25054r1_rule

STIG-ID|DG0101-ORACLE11

Vuln-ID|V-15620

DG0103-ORACLE11 - Network access to the DBMS must be restricted to authorized personnel - '$ORACLE_HOME/network/admin/cman.ora source and destination addresses are configured'

800-53|SC-7(12)

Rule-ID|SV-24410r2_rule

STIG-ID|DG0103-ORACLE11

Vuln-ID|V-15621

DG0103-ORACLE11 - Network access to the DBMS must be restricted to authorized personnel - '$ORACLE_HOME/network/admin/sqlnet.ora tcp.invited_nodes is configured'

800-53|SC-7

DG0103-ORACLE11 - Network access to the DBMS must be restricted to authorized personnel - '$ORACLE_HOME/network/admin/sqlnet.ora tcp.validnode_checking=yes'

800-53|SC-5

800-53|SC-7(5)

DG0104-ORACLE11 - DBMS service identification should be unique and clearly identifies the service.

Rule-ID|SV-24415r1_rule

STIG-ID|DG0104-ORACLE11

Vuln-ID|V-15622

DG0106-ORACLE11 - Database data encryption controls should be configured in accordance with application requirements.

Detections

Analytics

DISA STIG Oracle 11 Installation v9r1 Linux

Audit Details

File Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.5 Jun 17, 2024 Miscellaneous Metadata updated. References updated.
Revision 1.4 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated.
Revision 1.3 Mar 7, 2023 Miscellaneous Metadata updated. References updated. Variables updated.
Revision 1.2 Dec 7, 2022 Miscellaneous References updated.
Revision 1.1 Apr 25, 2022 Miscellaneous Metadata updated.

Detections

Analytics

DISA STIG Oracle 11 Installation v9r1 Linux Download File

Audit Details

File Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG Oracle 11 Installation v9r1 Linux