O112-BP-022200 - The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.

800-53|AC-6(7)

800-53|CM-6

CAT|II

CCI|CCI-000366

CSCv6|3.1

Rule-ID|SV-68221r4_rule

STIG-ID|O112-BP-022200

Vuln-ID|V-53981

O112-BP-022700 - The Oracle Listener must be configured to require administration authentication.

800-53|AC-17

CAT|I

Rule-ID|SV-68231r2_rule

STIG-ID|O112-BP-022700

Vuln-ID|V-53991

O112-BP-025101 - The directory assigned to the AUDIT_FILE_DEST parameter must be protected from unauthorized access and must be stored in a dedicated directory or disk partition separate from software or other application files.

Rule-ID|SV-72025r3_rule

STIG-ID|O112-BP-025101

Vuln-ID|V-57615

O112-BP-025300 - The DBMS must not share a host supporting an independent security service.

800-53|CM-7

Rule-ID|SV-68281r1_rule

STIG-ID|O112-BP-025300

Vuln-ID|V-54041

O112-BP-025400 - Access to DBMS software files and directories must not be granted to unauthorized users - '/etc/profile umask < 022'

Rule-ID|SV-68283r1_rule

STIG-ID|O112-BP-025400

Vuln-ID|V-54043

O112-BP-025400 - Access to DBMS software files and directories must not be granted to unauthorized users - 'umask < 0022'

O112-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - TCP.INVITED_NODES

800-53|SC-7

CSCv6|9.2

Rule-ID|SV-68287r2_rule

STIG-ID|O112-BP-025600

Vuln-ID|V-54047

O112-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - TCP.VALIDNODE_CHECKING

800-53|SC-5

800-53|SC-7(5)

O112-BP-026400 - The /diag subdirectory under the directory assigned to the DIAGNOSTIC_DEST parameter must be protected from unauthorized access.

Rule-ID|SV-68313r2_rule

STIG-ID|O112-BP-026400

Vuln-ID|V-54073

O112-BP-026500 - Remote administration must be disabled for the Oracle connection manager.

800-53|AC-3

CSCv6|9.1

Rule-ID|SV-68315r1_rule

STIG-ID|O112-BP-026500

Vuln-ID|V-54075

O112-BP-026600 - The SQLNet SQLNET.ALLOWED_LOGON_VERSION parameter must be set to a value of 12 or higher.

800-53|CM-7(5)

800-53|SI-2

CSCv6|2.2

Rule-ID|SV-68317r4_rule

STIG-ID|O112-BP-026600

Vuln-ID|V-54077

O112-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - DBA User Groups

CCI|CCI-000040

Rule-ID|SV-66341r2_rule

STIG-ID|O112-C1-004500

Vuln-ID|V-52125

O112-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - DBA User Rights

O112-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - ORA_[SID]_DBA

800-53|AC-6

O112-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - ORA_DBA group

O112-C1-011100 - Vendor-supported software must be evaluated and patched against newly found vulnerabilities.

CCI|CCI-001499

Rule-ID|SV-66543r3_rule

STIG-ID|O112-C1-011100

Vuln-ID|V-52327

O112-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CIPHER_SUITES

800-53|IA-2

CCI|CCI-000186

Rule-ID|SV-66547r5_rule

STIG-ID|O112-C1-015400

Vuln-ID|V-52331

O112-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CLIENT_AUTHENTICATION

O112-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_VERSION

800-53|IA-5(2)

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.CRYPTO_CHECKSUM_CLIENT

800-53|SC-8(1)

CCI|CCI-002418

Rule-ID|SV-66549r6_rule

STIG-ID|O112-C1-019700

Vuln-ID|V-52333

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.CRYPTO_CHECKSUM_SERVER

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.ENCRYPTION_TYPES_CLIENT

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.ENCRYPTION_TYPES_SERVER

O112-C2-001700 - The DBMS must support the disabling of network protocols deemed by the organization to be non-secure.

CCI|CCI-001436

Rule-ID|SV-66563r1_rule

STIG-ID|O112-C2-001700

Vuln-ID|V-52347

O112-C2-003400 - DBMS processes or services must run under custom, dedicated OS accounts.

800-53|AC-5

CCI|CCI-000037

Rule-ID|SV-66585r1_rule

STIG-ID|O112-C2-003400

Vuln-ID|V-52369

O112-C2-004400 - OS accounts utilized to run external procedures called by the DBMS must have limited privileges.

Rule-ID|SV-66615r2_rule

STIG-ID|O112-C2-004400

Vuln-ID|V-52399

O112-C2-011810 - Access to external executables must be disabled or restricted - 'extproc does not exist'

CCI|CCI-000381

Rule-ID|SV-74571r2_rule

STIG-ID|O112-C2-011810

Vuln-ID|V-60141

O112-C2-011810 - Access to external executables must be disabled or restricted - 'extproc.ora EXTPROC_DLLS=ANY does not exist'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'listener.ora EXTPROC is not in use'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'listener.ora EXTPROC_DLLS=ANY does not exist'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'ORACLE_HOME/hs/admin/extproc.ora exists'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'run_group=nobody'

800-53|CM-7(2)

CSCv6|8.4

O112-C2-011810 - Access to external executables must be disabled or restricted - 'run_user=nobody'

O112-C2-011900 - The DBMS must support the organizational requirements to specifically prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.

CCI|CCI-000382

Rule-ID|SV-66455r1_rule

STIG-ID|O112-C2-011900

Vuln-ID|V-52239

O112-C2-012900 - The DBMS must use multifactor authentication for network access to privileged accounts - SQLNET.AUTHENTICATION_SERVICES

CCI|CCI-000765

Rule-ID|SV-66471r5_rule

STIG-ID|O112-C2-012900

Vuln-ID|V-52255

O112-C2-012900 - The DBMS must use multifactor authentication for network access to privileged accounts - SSL_CIPHER_SUITES

O112-C2-012900 - The DBMS must use multifactor authentication for network access to privileged accounts - SSL_CLIENT_AUTHENTICATION

O112-C2-012900 - The DBMS must use multifactor authentication for network access to privileged accounts - SSL_VERSION

O112-C2-013000 - The DBMS must use multifactor authentication for network access to non-privileged accounts - SQLNET.AUTHENTICATION_SERVICES

CCI|CCI-000766

Rule-ID|SV-66473r5_rule

STIG-ID|O112-C2-013000

Vuln-ID|V-52257

O112-C2-013000 - The DBMS must use multifactor authentication for network access to non-privileged accounts - SSL_CIPHER_SUITES

O112-C2-013000 - The DBMS must use multifactor authentication for network access to non-privileged accounts - SSL_CLIENT_AUTHENTICATION

O112-C2-013000 - The DBMS must use multifactor authentication for network access to non-privileged accounts - SSL_VERSION

O112-C2-013100 - The DBMS must use multifactor authentication for local access to privileged accounts - SQLNET.AUTHENTICATION_SERVICES

CCI|CCI-000767

Rule-ID|SV-66475r5_rule

STIG-ID|O112-C2-013100

Vuln-ID|V-52259

O112-C2-013100 - The DBMS must use multifactor authentication for local access to privileged accounts - SSL_CIPHER_SUITES

O112-C2-013100 - The DBMS must use multifactor authentication for local access to privileged accounts - SSL_CLIENT_AUTHENTICATION

O112-C2-013100 - The DBMS must use multifactor authentication for local access to privileged accounts - SSL_VERSION

O112-C2-013200 - The DBMS must use multifactor authentication for local access to non-privileged accounts - SQLNET.AUTHENTICATION_SERVICES

CCI|CCI-000768

Rule-ID|SV-89705r3_rule

STIG-ID|O112-C2-013200

Vuln-ID|V-75031

O112-C2-013200 - The DBMS must use multifactor authentication for local access to non-privileged accounts - SSL_CIPHER_SUITES

O112-C2-013200 - The DBMS must use multifactor authentication for local access to non-privileged accounts - SSL_CLIENT_AUTHENTICATION

O112-C2-013200 - The DBMS must use multifactor authentication for local access to non-privileged accounts - SSL_VERSION

O112-C2-013600 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to privileged accounts - SQLNET.CRYPTO_CHECKSUM_CLIENT

CCI|CCI-000774

Rule-ID|SV-66481r5_rule

STIG-ID|O112-C2-013600

Vuln-ID|V-52265

O112-C2-013600 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to privileged accounts - SQLNET.CRYPTO_CHECKSUM_SERVER

O112-C2-013600 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to privileged accounts - SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT

O112-C2-013600 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to privileged accounts - SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER

O112-C2-013600 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to privileged accounts - SQLNET.ENCRYPTION_TYPES_CLIENT

O112-C2-013600 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to privileged accounts - SQLNET.ENCRYPTION_TYPES_SERVER

O112-C2-013700 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts - SQLNET.CRYPTO_CHECKSUM_CLIENT

CCI|CCI-000776

Rule-ID|SV-66483r5_rule

STIG-ID|O112-C2-013700

Vuln-ID|V-52267

O112-C2-013700 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts - SQLNET.CRYPTO_CHECKSUM_SERVER

O112-C2-013700 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts - SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT

O112-C2-013700 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts - SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER

O112-C2-013700 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts - SQLNET.ENCRYPTION_TYPES_CLIENT

O112-C2-013700 - The DBMS must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts - SQLNET.ENCRYPTION_TYPES_SERVER

O112-C2-014600 - The DBMS must support organizational requirements to enforce password encryption for storage.

CCI|CCI-000196

Rule-ID|SV-66501r4_rule

STIG-ID|O112-C2-014600

Vuln-ID|V-52285

O112-C2-015100 - DBMS passwords must not be stored in compiled, encoded, or encrypted batch jobs or compiled, encoded, or encrypted application source code.

CCI|CCI-000199

Rule-ID|SV-66505r5_rule

STIG-ID|O112-C2-015100

Vuln-ID|V-52289

O112-C2-015300 - The DBMS, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor - SSL_CIPHER_SUITES

CCI|CCI-000185

Rule-ID|SV-66509r5_rule

STIG-ID|O112-C2-015300

Vuln-ID|V-52293

O112-C2-015300 - The DBMS, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor - SSL_CLIENT_AUTHENTICATION

O112-C2-015300 - The DBMS, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor - SSL_VERSION

O112-C2-015500 - The DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account - SSL_CIPHER_SUITES

CCI|CCI-000187

Rule-ID|SV-66511r4_rule

STIG-ID|O112-C2-015500

Vuln-ID|V-52295

O112-C2-015500 - The DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account - SSL_CLIENT_AUTHENTICATION

O112-C2-015500 - The DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account - SSL_VERSION

O112-C2-015700 - The DBMS must use  NIST-validated FIPS 140-2-compliant cryptography for authentication mechanisms.

Detections

Analytics

DISA STIG Oracle 11.2g v1r18 Windows

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.5 Nov 23, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.4 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.3 Jun 17, 2021 Miscellaneous Metadata updated.
Revision 1.2 Apr 22, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Sep 29, 2020 Miscellaneous References updated.