DG0001-ORACLE11 - Vendor supported software is evaluated and patched against newly found vulnerabilities.

CAT|I

Rule-ID|SV-24339r2_rule

STIG-ID|DG0001-ORACLE11

Vuln-ID|V-5658

DG0003-ORACLE11 - The latest security patches should be installed.

CAT|II

Rule-ID|SV-24342r1_rule

STIG-ID|DG0003-ORACLE11

Vuln-ID|V-5659

DG0005-ORACLE11 - Only necessary privileges to the host system should be granted to DBA OS accounts - 'ORA_{SID}_DBA Group has no unauthorized users'

800-53|AC-6(7)

Rule-ID|SV-24346r1_rule

STIG-ID|DG0005-ORACLE11

Vuln-ID|V-6756

DG0005-ORACLE11 - Only necessary privileges to the host system should be granted to DBA OS accounts - 'ORA_DBA Group has no unauthorized users'

800-53|AC-6

DG0005-ORACLE11 - Only necessary privileges to the host system should be granted to DBA OS accounts - 'Oracle DBA is only a member of ORA_DBA and Users group'

800-53|AC-6(5)

DG0005-ORACLE11 - Only necessary privileges to the host system should be granted to DBA OS accounts - 'Oracle instance DBA is only a member of ORA_{SID}_DBA and Users group'

800-53|AC-2c.

DG0007-ORACLE11 - The database should be secured in accordance with DoD, vendor and/or commercially accepted practices where applicable.

Rule-ID|SV-30742r1_rule

STIG-ID|DG0007-ORACLE11

Vuln-ID|V-6767

DG0009-ORACLE11 - Access to DBMS software files and directories should not be granted to unauthorized users - '%ORACLE_HOME% permissions are configured correctly'

800-53|CM-6b.

Rule-ID|SV-24595r1_rule

STIG-ID|DG0009-ORACLE11

Vuln-ID|V-15608

DG0010-ORACLE11 - Database executable and configuration files should be monitored for unauthorized modifications.

CAT|III

Rule-ID|SV-24597r1_rule

STIG-ID|DG0010-ORACLE11

Vuln-ID|V-2420

DG0011-ORACLE11 - Configuration management procedures should be defined and implemented for database software modifications.

Rule-ID|SV-24599r1_rule

STIG-ID|DG0011-ORACLE11

Vuln-ID|V-3726

DG0012-ORACLE11 - Database software directories including DBMS configuration files are stored in dedicated directories separate from the host OS and other applications - 'ORACLE_BASE environment variable set'

Rule-ID|SV-24350r1_rule

STIG-ID|DG0012-ORACLE11

Vuln-ID|V-4754

DG0012-ORACLE11 - Database software directories including DBMS configuration files are stored in dedicated directories separate from the host OS and other applications - 'ORACLE_HOME environment variable set'

DG0013-ORACLE11 - Database backup procedures should be defined, documented and implemented.

Rule-ID|SV-30765r1_rule

STIG-ID|DG0013-ORACLE11

Vuln-ID|V-15126

DG0016-ORACLE11 - Unused database components, database application software, and database objects should be removed from the DBMS system.

Rule-ID|SV-24359r2_rule

STIG-ID|DG0016-ORACLE11

Vuln-ID|V-3728

DG0017-ORACLE11 - A production DBMS installation should not coexist on the same DBMS host with other, non-production DBMS installations - 'All Oracle instances are documented and approved'

800-53|CM-7a.

Rule-ID|SV-24606r1_rule

STIG-ID|DG0017-ORACLE11

Vuln-ID|V-3803

DG0019-ORACLE11 - Application software should be owned by a Software Application account - 'Oracle base directory file permissions are correct'

Rule-ID|SV-24363r1_rule

STIG-ID|DG0019-ORACLE11

Vuln-ID|V-3805

DG0019-ORACLE11 - Application software should be owned by a Software Application account - 'Oracle home directory file permissions are correct'

DG0020-ORACLE11 - Backup and recovery procedures should be developed, documented, implemented and periodically tested.

Rule-ID|SV-24608r1_rule

STIG-ID|DG0020-ORACLE11

Vuln-ID|V-15129

DG0021-ORACLE11 - A baseline of database application software should be documented and maintained.

Rule-ID|SV-24610r1_rule

STIG-ID|DG0021-ORACLE11

Vuln-ID|V-3806

DG0025-ORACLE11 - DBMS cryptography must be NIST FIPS 140-2 validated - '%ORACLE_HOME%\NETWORK\ADMIN\SQLNET.ora SQLNET.SSLFIPS_140 = TRUE'

800-53|SC-13

Rule-ID|SV-55867r1_rule

STIG-ID|DG0025-ORACLE11

Vuln-ID|V-43137

DG0025-ORACLE11 - DBMS cryptography must be NIST FIPS 140-2 validated - '%ORACLE_HOME%\NETWORK\ADMIN\SQLNET.ora SSL_CIPHER_SUITES set to valid cipher suite'

DG0025-ORACLE11 - DBMS cryptography must be NIST FIPS 140-2 validated - 'Oracle Advanced Security is installed'

DG0040-ORACLE11 - The DBMS software installation account should be restricted to authorized users - 'Oracle base directory file permissions are correct'

Rule-ID|SV-24374r2_rule

STIG-ID|DG0040-ORACLE11

Vuln-ID|V-2422

DG0040-ORACLE11 - The DBMS software installation account should be restricted to authorized users - 'Oracle home directory file permissions are correct'

DG0041-ORACLE11 - Use of the DBMS installation account should be logged.

Rule-ID|SV-24377r1_rule

STIG-ID|DG0041-ORACLE11

Vuln-ID|V-15110

DG0042-ORACLE11 - Use of the DBMS software installation account should be restricted to DBMS software installation, upgrade and maintenance actions.

Rule-ID|SV-24379r1_rule

STIG-ID|DG0042-ORACLE11

Vuln-ID|V-15111

DG0050-ORACLE11 - Database software, applications and configuration files should be monitored to discover unauthorized changes.

Rule-ID|SV-24383r1_rule

STIG-ID|DG0050-ORACLE11

Vuln-ID|V-2423

DG0052-ORACLE11 - All applications that access the database should be logged in the audit trail.

Rule-ID|SV-24626r1_rule

STIG-ID|DG0052-ORACLE11

Vuln-ID|V-3807

DG0053-ORACLE11 - A single database connection configuration file should not be used to configure all database clients.

Rule-ID|SV-24628r1_rule

STIG-ID|DG0053-ORACLE11

Vuln-ID|V-3809

DG0054-ORACLE11 - The audit logs should be periodically monitored to discover DBMS access using unauthorized applications.

Rule-ID|SV-24630r1_rule

STIG-ID|DG0054-ORACLE11

Vuln-ID|V-15611

DG0063-ORACLE11 - DBMS privileges to restore database data or other DBMS configurations, features, or objects should be restricted to authorized DBMS accounts.

Rule-ID|SV-24635r2_rule

STIG-ID|DG0063-ORACLE11

Vuln-ID|V-15107

DG0064-ORACLE11 - DBMS backup and restoration files should be protected from unauthorized access.

Rule-ID|SV-24637r1_rule

STIG-ID|DG0064-ORACLE11

Vuln-ID|V-15120

DG0066-ORACLE11 - Procedures for establishing temporary passwords that meet DoD password requirements for new accounts should be defined, documented and implemented.

Rule-ID|SV-24639r1_rule

STIG-ID|DG0066-ORACLE11

Vuln-ID|V-3811

DG0067-ORACLE11 - Database account passwords should be stored in encoded or encrypted format whether stored in database objects, external host files, environment variables or any other storage locations.

800-53|IA-5(1)(c)

Rule-ID|SV-24641r1_rule

STIG-ID|DG0067-ORACLE11

Vuln-ID|V-3812

DG0068-ORACLE11 - DBMS tools or applications that echo or require a password entry in clear text should be protected from password display.

Rule-ID|SV-24643r1_rule

STIG-ID|DG0068-ORACLE11

Vuln-ID|V-3813

DG0069-ORACLE11 - Procedures and restrictions for import of production data to development databases should be documented, implemented and followed.

Rule-ID|SV-24645r1_rule

STIG-ID|DG0069-ORACLE11

Vuln-ID|V-15140

DG0083-ORACLE11 - Automated notification of suspicious activity detected in the audit trail should be implemented.

Rule-ID|SV-24670r1_rule

STIG-ID|DG0083-ORACLE11

Vuln-ID|V-15102

DG0086-ORACLE11 - DBA roles should be periodically monitored to detect assignment of unauthorized or excess privileges.

Rule-ID|SV-24675r1_rule

STIG-ID|DG0086-ORACLE11

Vuln-ID|V-15106

DG0088-ORACLE11 - The DBMS should be periodically tested for vulnerability management and IA compliance.

Rule-ID|SV-24678r1_rule

STIG-ID|DG0088-ORACLE11

Vuln-ID|V-15112

DG0090-ORACLE11 - Sensitive information stored in the database should be protected by encryption.

Rule-ID|SV-24397r1_rule

STIG-ID|DG0090-ORACLE11

Vuln-ID|V-15131

DG0092-ORACLE11 - Database data files containing sensitive information should be encrypted.

Rule-ID|SV-24684r1_rule

STIG-ID|DG0092-ORACLE11

Vuln-ID|V-15132

DG0093-ORACLE11 - Remote adminstrative connections to the database should be encrypted - '%ORACLE_HOME%\ldap\admin\fips.ora SSLFIPS_140 = TRUE'

Rule-ID|SV-24687r1_rule

STIG-ID|DG0093-ORACLE11

Vuln-ID|V-3825

DG0093-ORACLE11 - Remote adminstrative connections to the database should be encrypted - all protocols use TCPS'

800-53|AC-17(2)

DG0095-ORACLE11 - Audit trail data should be reviewed daily or more frequently.

Rule-ID|SV-24405r1_rule

STIG-ID|DG0095-ORACLE11

Vuln-ID|V-3827

DG0096-ORACLE11 - The DBMS IA policies and procedures should be reviewed annually or more frequently.

Rule-ID|SV-24689r1_rule

STIG-ID|DG0096-ORACLE11

Vuln-ID|V-15138

DG0097-ORACLE11 - Plans and procedures for testing DBMS installations, upgrades and patches should be defined and followed prior to production implementation.

Rule-ID|SV-24691r1_rule

STIG-ID|DG0097-ORACLE11

Vuln-ID|V-15139

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '%ORACLE_HOME%\bin\extproc.exe does not exist'

800-53|CM-7b.

Rule-ID|SV-24698r1_rule

STIG-ID|DG0099-ORACLE11

Vuln-ID|V-15618

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '%ORACLE_HOME%\hs\admin\extproc.ora SET EXTPROC_DLLS = ONLY'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '%ORACLE_HOME%\hs\admin\extproc.ora SET EXTPROC_DLLS contains only valid paths'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '%ORACLE_HOME%\rdbms\admin\externaljob.ora run_group = nobody'

800-53|CM-7(2)

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - '%ORACLE_HOME%\rdbms\admin\externaljob.ora run_user = nobody'

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - no PROGRAMS = EXTPROC' - listener.ora

DG0099-ORACLE11 - Access to external DBMS executables should be disabled or restricted - no PROGRAMS = EXTPROC' - tnsnames.ora

DG0101-ORACLE11 - OS accounts used to execute external procedures should be assigned minimum privileges.

Rule-ID|SV-25054r1_rule

STIG-ID|DG0101-ORACLE11

Vuln-ID|V-15620

DG0103-ORACLE11 - Network access to the DBMS must be restricted to authorized personnel - '%ORACLE_HOME%\NETWORK\ADMIN\SQLNET.ORA tcp.invited_nodes = valid IP Range'

800-53|SC-7(12)

Rule-ID|SV-24410r2_rule

STIG-ID|DG0103-ORACLE11

Vuln-ID|V-15621

DG0103-ORACLE11 - Network access to the DBMS must be restricted to authorized personnel - '%ORACLE_HOME%\NETWORK\ADMIN\SQLNET.ORA tcp.validnode_checking = YES'

800-53|SC-5

800-53|SC-7(5)

DG0103-ORACLE11 - Network access to the DBMS must be restricted to authorized personnel - valid source and destination IPs are used in rules'

DG0104-ORACLE11 - DBMS service identification should be unique and clearly identifies the service - 'All Oracle services use the proper naming'

Rule-ID|SV-24415r1_rule

STIG-ID|DG0104-ORACLE11

Vuln-ID|V-15622

DG0106-ORACLE11 - Database data encryption controls should be configured in accordance with application requirements.

Detections

Analytics

DISA STIG Oracle 11 Installation v9r1 Windows

Audit Details

File Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.5 Jun 17, 2024 Miscellaneous Metadata updated. References updated.
Revision 1.4 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated.
Revision 1.3 Mar 7, 2023 Miscellaneous Metadata updated. References updated. Variables updated.
Revision 1.2 Dec 7, 2022 Miscellaneous References updated.
Revision 1.1 Apr 25, 2022 Miscellaneous Metadata updated.

Detections

Analytics

DISA STIG Oracle 11 Installation v9r1 Windows Download File

Audit Details

File Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG Oracle 11 Installation v9r1 Windows