DISA_STIG_Oracle_Database_11.2g_v2r3_OS_Linux.audit from DISA Oracle Database 11.2g v2r3 STIG

O112-BP-022200 - The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.

CAT|II

CCI|CCI-000366

Rule-ID|SV-219705r401224_rule

STIG-ID|O112-BP-022200

STIG-Legacy|SV-68221

STIG-Legacy|V-53981

Vuln-ID|V-219705

O112-BP-022700 - The Oracle Listener must be configured to require administration authentication.

CAT|I

Rule-ID|SV-219710r401224_rule

STIG-ID|O112-BP-022700

STIG-Legacy|SV-68231

STIG-Legacy|V-53991

Vuln-ID|V-219710

O112-BP-025101 - The directory assigned to the AUDIT_FILE_DEST parameter must be protected from unauthorized access and must be stored in a dedicated directory or disk partition separate from software or other application files - 'AUDIT_FILE_DEST not in ORACLEHOME'

Rule-ID|SV-219733r401224_rule

STIG-ID|O112-BP-025101

STIG-Legacy|SV-72025

STIG-Legacy|V-57615

Vuln-ID|V-219733

O112-BP-025101 - The directory assigned to the AUDIT_FILE_DEST parameter must be protected from unauthorized access and must be stored in a dedicated directory or disk partition separate from software or other application files - 'AUDIT_FILE_DEST Permissions'

O112-BP-025400 - Access to DBMS software files and directories must not be granted to unauthorized users - '/etc/profile umask < 022'

Rule-ID|SV-219736r401224_rule

STIG-ID|O112-BP-025400

STIG-Legacy|SV-68283

STIG-Legacy|V-54043

Vuln-ID|V-219736

O112-BP-025400 - Access to DBMS software files and directories must not be granted to unauthorized users - 'umask < 0022'

O112-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - TCP.INVITED_NODES

Rule-ID|SV-219738r401224_rule

STIG-ID|O112-BP-025600

STIG-Legacy|SV-68287

STIG-Legacy|V-54047

Vuln-ID|V-219738

O112-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - TCP.VALIDNODE_CHECKING

O112-BP-026400 - The /diag subdirectory under the directory assigned to the DIAGNOSTIC_DEST parameter must be protected from unauthorized access - Ownership

Rule-ID|SV-219744r401224_rule

STIG-ID|O112-BP-026400

STIG-Legacy|SV-68313

STIG-Legacy|V-54073

Vuln-ID|V-219744

O112-BP-026400 - The /diag subdirectory under the directory assigned to the DIAGNOSTIC_DEST parameter must be protected from unauthorized access - Permissions

O112-BP-026500 - Remote administration must be disabled for the Oracle connection manager.

Rule-ID|SV-219745r401224_rule

STIG-ID|O112-BP-026500

STIG-Legacy|SV-68315

STIG-Legacy|V-54075

Vuln-ID|V-219745

O112-BP-026600 - The SQLNet SQLNET.ALLOWED_LOGON_VERSION parameter must be set to a value of 12 or higher.

Rule-ID|SV-219746r401224_rule

STIG-ID|O112-BP-026600

STIG-Legacy|SV-68317

STIG-Legacy|V-54077

Vuln-ID|V-219746

O112-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - DBA group

Rule-ID|SV-238431r667467_rule

STIG-ID|O112-C1-004500

STIG-Legacy|SV-66341

STIG-Legacy|V-52125

Vuln-ID|V-238431

O112-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - Root group

O112-C1-011100 - Vendor-supported software must be evaluated and patched against newly found vulnerabilities.

CCI|CCI-002605

Rule-ID|SV-238432r667470_rule

STIG-ID|O112-C1-011100

STIG-Legacy|SV-66543

STIG-Legacy|V-52327

Vuln-ID|V-238432

O112-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CIPHER_SUITES

CCI|CCI-000186

Rule-ID|SV-219747r799968_rule

STIG-ID|O112-C1-015400

STIG-Legacy|SV-66547

STIG-Legacy|V-52331

Vuln-ID|V-219747

O112-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CLIENT_AUTHENTICATION

O112-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_VERSION

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.CRYPTO_CHECKSUM_CLIENT

CCI|CCI-002420

Rule-ID|SV-238434r667476_rule

STIG-ID|O112-C1-019700

STIG-Legacy|SV-66549

STIG-Legacy|V-52333

Vuln-ID|V-238434

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.ENCRYPTION_TYPES_CLIENT

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SQLNET.ENCRYPTION_TYPES_SERVER

O112-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures.

O112-C2-001700 - The DBMS must support the disabling of network protocols deemed by the organization to be non-secure.

CCI|CCI-000382

Rule-ID|SV-238435r667479_rule

STIG-ID|O112-C2-001700

STIG-Legacy|SV-66563

STIG-Legacy|V-52347

Vuln-ID|V-238435

O112-C2-004400 - OS accounts utilized to run external procedures called by the DBMS must have limited privileges.

CCI|CCI-000381

Rule-ID|SV-238447r667515_rule

STIG-ID|O112-C2-004400

STIG-Legacy|SV-66615

STIG-Legacy|V-52399

Vuln-ID|V-238447

O112-C2-011810 - Access to external executables must be disabled or restricted - 'extproc does not exist'

Rule-ID|SV-219772r395853_rule

STIG-ID|O112-C2-011810

STIG-Legacy|SV-74571

STIG-Legacy|V-60141

Vuln-ID|V-219772

O112-C2-011810 - Access to external executables must be disabled or restricted - 'extproc.ora EXTPROC_DLLS=ANY does not exist'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'listener.ora EXTPROC is not in use'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'listener.ora EXTPROC_DLLS=ANY does not exist'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'ORACLE_HOME/hs/admin/extproc.ora exists'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'run_group=nobody'

O112-C2-011810 - Access to external executables must be disabled or restricted - 'run_user=nobody'

O112-C2-011900 - The DBMS must support the organizational requirements to specifically prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.

Rule-ID|SV-219773r395856_rule

STIG-ID|O112-C2-011900

STIG-Legacy|SV-66455

STIG-Legacy|V-52239

Vuln-ID|V-219773

O112-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SQLNET.AUTHENTICATION_SERVICES

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-000767

CCI|CCI-000768

Rule-ID|SV-238458r667548_rule

STIG-ID|O112-C2-012900

STIG-Legacy|SV-66471

STIG-Legacy|V-52255

Vuln-ID|V-238458

O112-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_CIPHER_SUITES

O112-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_CLIENT_AUTHENTICATION

O112-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_VERSION

O112-C2-014600 - The DBMS must support organizational requirements to enforce password encryption for storage.

CCI|CCI-000196

Rule-ID|SV-219774r397522_rule

STIG-ID|O112-C2-014600

STIG-Legacy|SV-66501

STIG-Legacy|V-52285

Vuln-ID|V-219774

O112-C2-015100 - DBMS passwords must not be stored in compiled, encoded, or encrypted batch jobs or compiled, encoded, or encrypted application source code.

Rule-ID|SV-238469r667581_rule

STIG-ID|O112-C2-015100

STIG-Legacy|SV-66505

STIG-Legacy|V-52289

Vuln-ID|V-238469

O112-C2-015300 - The DBMS, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor - SSL_CIPHER_SUITES

CCI|CCI-000185

Rule-ID|SV-219775r799970_rule

STIG-ID|O112-C2-015300

STIG-Legacy|SV-66509

STIG-Legacy|V-52293

Vuln-ID|V-219775

O112-C2-015300 - The DBMS, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor - SSL_CLIENT_AUTHENTICATION

O112-C2-015300 - The DBMS, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor - SSL_VERSION

O112-C2-015500 - The DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account - SSL_CIPHER_SUITES

CCI|CCI-000187

Rule-ID|SV-219776r397600_rule

STIG-ID|O112-C2-015500

STIG-Legacy|SV-66511

STIG-Legacy|V-52295

Vuln-ID|V-219776

O112-C2-015500 - The DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account - SSL_CLIENT_AUTHENTICATION

O112-C2-015500 - The DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account - SSL_VERSION

O112-C2-015700 - The DBMS must use  NIST-validated FIPS 140-2-compliant cryptography for authentication mechanisms.

CCI|CCI-000803

Rule-ID|SV-219778r397606_rule

STIG-ID|O112-C2-015700

STIG-Legacy|SV-66513

STIG-Legacy|V-52297

Vuln-ID|V-219778

O112-C2-019100 - The DBMS must protect against or limit the effects of the organization-defined types of Denial of Service (DoS) attacks.

CCI|CCI-000054

Rule-ID|SV-238477r667605_rule

STIG-ID|O112-C2-019100

STIG-Legacy|SV-66377

STIG-Legacy|V-52161

Vuln-ID|V-238477

O112-N1-015602 - When using command-line tools such as Oracle SQL*Plus, which can accept a plain-text password, users must use an alternative login method that does not expose the password.

Detections

Analytics

DISA STIG Oracle 11.2g v2r3 Linux

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Revision 1.0

Miscellaneous