O121-BP-022200 - The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.

800-53|CM-6

CAT|II

CCI|CCI-000366

CSCv6|3.1

Rule-ID|SV-219833r533040_rule

STIG-ID|O121-BP-022200

STIG-Legacy|SV-75921

STIG-Legacy|V-61431

Vuln-ID|V-219833

O121-BP-022700 - The Oracle Listener must be configured to require administration authentication.

800-53|AC-6(1)

CAT|I

Rule-ID|SV-219838r533055_rule

STIG-ID|O121-BP-022700

STIG-Legacy|SV-75931

STIG-Legacy|V-61441

Vuln-ID|V-219838

O121-BP-024100 - DBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.

800-53|AC-6

Rule-ID|SV-219852r401224_rule

STIG-ID|O121-BP-024100

STIG-Legacy|SV-75977

STIG-Legacy|V-61487

Vuln-ID|V-219852

O121-BP-025400 - Access to DBMS software files and directories must not be granted to unauthorized users - /etc/profile umask < 022

800-53|AC-3(4)

Rule-ID|SV-219865r401224_rule

STIG-ID|O121-BP-025400

STIG-Legacy|SV-76001

STIG-Legacy|V-61511

Vuln-ID|V-219865

O121-BP-025400 - Access to DBMS software files and directories must not be granted to unauthorized users - umask < 0022

O121-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - cman.ora

800-53|SC-7(12)

CSCv6|9.2

Rule-ID|SV-219867r401224_rule

STIG-ID|O121-BP-025600

STIG-Legacy|SV-76005

STIG-Legacy|V-61515

Vuln-ID|V-219867

O121-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - tcp.validnode_checking=YES

800-53|SC-5

800-53|SC-7(5)

O121-BP-025600 - Network access to the DBMS must be restricted to authorized personnel.

800-53|SC-7

O121-BP-026500 - Remote administration must be disabled for the Oracle connection manager.

800-53|AC-3

800-53|AC-17

800-53|CM-7

CSCv6|9.1

Rule-ID|SV-219874r401224_rule

STIG-ID|O121-BP-026500

STIG-Legacy|SV-76023

STIG-Legacy|V-61533

Vuln-ID|V-219874

O121-BP-026600 - Network client connections must be restricted to supported versions - SQLNET.ALLOWED_LOGON_VERSION_CLIENT

Rule-ID|SV-219875r401224_rule

STIG-ID|O121-BP-026600

STIG-Legacy|SV-76025

STIG-Legacy|V-61535

Vuln-ID|V-219875

O121-BP-026600 - Network client connections must be restricted to supported versions - SQLNET.ALLOWED_LOGON_VERSION_SERVER

O121-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - DBA Group

Rule-ID|SV-237696r667120_rule

STIG-ID|O121-C1-004500

STIG-Legacy|SV-76027

STIG-Legacy|V-61537

Vuln-ID|V-237696

O121-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS - Root Group

O121-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CIPHER_SUITES

800-53|IA-2

CCI|CCI-000186

Rule-ID|SV-220263r799974_rule

STIG-ID|O121-C1-015400

STIG-Legacy|SV-76033

STIG-Legacy|V-61543

Vuln-ID|V-220263

O121-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CLIENT_AUTHENTICATION

O121-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_VERSION

800-53|IA-5(2)

O121-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - CLIENT

800-53|SC-8(1)

CCI|CCI-002421

Rule-ID|SV-237699r667129_rule

STIG-ID|O121-C1-019700

STIG-Legacy|SV-76035

STIG-Legacy|V-61545

Vuln-ID|V-237699

O121-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SERVER

O121-C2-001700 - The DBMS must support the disabling of network protocols deemed by the organization to be nonsecure.

CCI|CCI-000382

Rule-ID|SV-237700r667132_rule

STIG-ID|O121-C2-001700

STIG-Legacy|SV-76045

STIG-Legacy|V-61555

Vuln-ID|V-237700

O121-C2-004400 - OS accounts utilized to run external procedures called by the DBMS must have limited privileges - run_group

800-53|CM-7(2)

CCI|CCI-000381

CSCv6|8.4

Rule-ID|SV-237712r667168_rule

STIG-ID|O121-C2-004400

STIG-Legacy|SV-76091

STIG-Legacy|V-61601

Vuln-ID|V-237712

O121-C2-004400 - OS accounts utilized to run external procedures called by the DBMS must have limited privileges - run_user

O121-C2-011810 - Access to external executables must be disabled or restricted - 'listener.ora EXTPROC is not in use'

Rule-ID|SV-220288r395853_rule

STIG-ID|O121-C2-011810

STIG-Legacy|SV-76175

STIG-Legacy|V-61685

Vuln-ID|V-220288

O121-C2-011810 - Access to external executables must be disabled or restricted - 'run_group=nobody'

O121-C2-011810 - Access to external executables must be disabled or restricted - 'run_user=nobody'

O121-C2-011810 - Access to external executables must be disabled or restricted - extproc does not exist

O121-C2-011810 - Access to external executables must be disabled or restricted - extproc.ora EXTPROC_DLLS=ANY does not exist

O121-C2-011810 - Access to external executables must be disabled or restricted - listener.ora EXTPROC_DLLS=ANY does not exist

O121-C2-011810 - Access to external executables must be disabled or restricted - ORACLE_HOME/hs/admin/extproc.ora exists

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SQLNET.AUTHENTICATION_SERVICES

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-000767

CCI|CCI-000768

Rule-ID|SV-237723r667201_rule

STIG-ID|O121-C2-012900

STIG-Legacy|SV-76193

STIG-Legacy|V-61703

Vuln-ID|V-237723

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_CIPHER_SUITES

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_CLIENT_AUTHENTICATION

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_VERSION

O121-C2-014600 - The DBMS must support organizational requirements to enforce password encryption for storage.

CCI|CCI-000196

Rule-ID|SV-220290r397522_rule

STIG-ID|O121-C2-014600

STIG-Legacy|SV-76223

STIG-Legacy|V-61733

Vuln-ID|V-220290

O121-C2-015100 - DBMS passwords must not be stored in compiled, encoded, or encrypted batch jobs or compiled, encoded, or encrypted application source code.

Rule-ID|SV-237734r667234_rule

STIG-ID|O121-C2-015100

STIG-Legacy|SV-76227

STIG-Legacy|V-61737

Vuln-ID|V-237734

O121-C2-019100 - The DBMS must protect against or limit the effects of organization-defined types of Denial of Service (DoS) attacks.

CCI|CCI-002385

Rule-ID|SV-237742r667258_rule

STIG-ID|O121-C2-019100

STIG-Legacy|SV-76273

STIG-Legacy|V-61783

Vuln-ID|V-237742

O121-N1-015602 - When using command-line tools such as Oracle SQL*Plus, which can accept a plain-text password, users must use an alternative logon method that does not expose the password.

Detections

Analytics

DISA STIG Oracle 12c v2r3 Linux

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 May 17, 2022 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Apr 25, 2022 Miscellaneous References updated.