DISA_STIG_Oracle_Database_12c_v2r8_Database.audit from DISA Oracle Database 12c v2r8 STIG

O121-BP-021200 - Access to default accounts used to support replication must be restricted to authorized DBAs.

CAT|II

CCI|CCI-000366

Rule-ID|SV-219824r879887_rule

STIG-ID|O121-BP-021200

STIG-Legacy|SV-75901

STIG-Legacy|V-61411

Vuln-ID|V-219824

O121-BP-021300 - Oracle instance names must not contain Oracle version numbers.

Rule-ID|SV-219825r879887_rule

STIG-ID|O121-BP-021300

STIG-Legacy|SV-75903

STIG-Legacy|V-61413

Vuln-ID|V-219825

O121-BP-021400 - Fixed user and public database links must be authorized for use.

Rule-ID|SV-219826r879887_rule

STIG-ID|O121-BP-021400

STIG-Legacy|SV-75905

STIG-Legacy|V-61415

Vuln-ID|V-219826

O121-BP-021500 - A minimum of two Oracle control files must be defined and configured to be stored on separate, archived disks (physical or virtual) or archived partitions on a RAID device.

CAT|III

Rule-ID|SV-219827r879887_rule

STIG-ID|O121-BP-021500

STIG-Legacy|SV-75907

STIG-Legacy|V-61417

Vuln-ID|V-219827

O121-BP-021600 - A minimum of two Oracle redo log groups/files must be defined and configured to be stored on separate, archived physical disks or archived directories on a RAID device

Rule-ID|SV-219828r879887_rule

STIG-ID|O121-BP-021600

STIG-Legacy|SV-75909

STIG-Legacy|V-61419

Vuln-ID|V-219828

O121-BP-021700 - The Oracle WITH GRANT OPTION privilege must not be granted to non-DBA or non-Application administrator user accounts.

Rule-ID|SV-219829r879887_rule

STIG-ID|O121-BP-021700

STIG-Legacy|SV-75911

STIG-Legacy|V-61421

Vuln-ID|V-219829

O121-BP-021900 - The Oracle REMOTE_OS_AUTHENT parameter must be set to FALSE.

CAT|I

Rule-ID|SV-219830r879887_rule

STIG-ID|O121-BP-021900

STIG-Legacy|SV-75915

STIG-Legacy|V-61425

Vuln-ID|V-219830

O121-BP-022000 - The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.

Rule-ID|SV-219831r903017_rule

STIG-ID|O121-BP-022000

STIG-Legacy|SV-75917

STIG-Legacy|V-61427

Vuln-ID|V-219831

O121-BP-022100 - The Oracle SQL92_SECURITY parameter must be set to TRUE.

Rule-ID|SV-219832r879887_rule

STIG-ID|O121-BP-022100

STIG-Legacy|SV-75919

STIG-Legacy|V-61429

Vuln-ID|V-219832

O121-BP-022200 - The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.

Rule-ID|SV-219833r879887_rule

STIG-ID|O121-BP-022200

STIG-Legacy|SV-75921

STIG-Legacy|V-61431

Vuln-ID|V-219833

O121-BP-022300 - System privileges granted using the WITH ADMIN OPTION must not be granted to unauthorized user accounts.

Rule-ID|SV-219834r879887_rule

STIG-ID|O121-BP-022300

STIG-Legacy|SV-75923

STIG-Legacy|V-61433

Vuln-ID|V-219834

O121-BP-022400 - System Privileges must not be granted to PUBLIC.

Rule-ID|SV-219835r879887_rule

STIG-ID|O121-BP-022400

STIG-Legacy|SV-75925

STIG-Legacy|V-61435

Vuln-ID|V-219835

O121-BP-022500 - Oracle roles granted using the WITH ADMIN OPTION must not be granted to unauthorized accounts.

Rule-ID|SV-219836r879887_rule

STIG-ID|O121-BP-022500

STIG-Legacy|SV-75927

STIG-Legacy|V-61437

Vuln-ID|V-219836

O121-BP-022600 - Object permissions granted to PUBLIC must be restricted.

Rule-ID|SV-219837r879887_rule

STIG-ID|O121-BP-022600

STIG-Legacy|SV-75929

STIG-Legacy|V-61439

Vuln-ID|V-219837

O121-BP-022800 - Application role permissions must not be assigned to the Oracle PUBLIC role.

Rule-ID|SV-219839r879887_rule

STIG-ID|O121-BP-022800

STIG-Legacy|SV-75933

STIG-Legacy|V-61443

Vuln-ID|V-219839

O121-BP-022900 - Oracle application administration roles must be disabled if not required and authorized.

Rule-ID|SV-219840r879887_rule

STIG-ID|O121-BP-022900

STIG-Legacy|SV-75935

STIG-Legacy|V-61445

Vuln-ID|V-219840

O121-BP-023000 - Connections by mid-tier web and application systems to the Oracle DBMS from a DMZ or external network must be encrypted.

Rule-ID|SV-219841r879887_rule

STIG-ID|O121-BP-023000

STIG-Legacy|SV-75937

STIG-Legacy|V-61447

Vuln-ID|V-219841

O121-BP-023100 - Database job/batch queues must be reviewed regularly to detect unauthorized database job submissions

Rule-ID|SV-219842r879887_rule

STIG-ID|O121-BP-023100

STIG-Legacy|SV-75939

STIG-Legacy|V-61449

Vuln-ID|V-219842

O121-BP-023200 - Unauthorized database links must not be defined and active.

Rule-ID|SV-219843r879887_rule

STIG-ID|O121-BP-023200

STIG-Legacy|SV-75941

STIG-Legacy|V-61451

Vuln-ID|V-219843

O121-BP-023300 - Sensitive information from production database exports must be modified before import to a development database.

Rule-ID|SV-219844r879887_rule

STIG-ID|O121-BP-023300

STIG-Legacy|SV-75943

STIG-Legacy|V-61453

Vuln-ID|V-219844

O121-BP-023600 - Only authorized system accounts must have the SYSTEM tablespace specified as the default tablespace

Rule-ID|SV-219847r879887_rule

STIG-ID|O121-BP-023600

STIG-Legacy|SV-75949

STIG-Legacy|V-61459

Vuln-ID|V-219847

O121-BP-023700 - Application owner accounts must have a dedicated application tablespace.

Rule-ID|SV-219848r879887_rule

STIG-ID|O121-BP-023700

STIG-Legacy|SV-75951

STIG-Legacy|V-61461

Vuln-ID|V-219848

O121-BP-023800 - The directories assigned to the LOG_ARCHIVE_DEST* parameters must be protected from unauthorized access.

Rule-ID|SV-219849r879887_rule

STIG-ID|O121-BP-023800

STIG-Legacy|SV-75953

STIG-Legacy|V-61463

Vuln-ID|V-219849

O121-BP-023900 - The Oracle _TRACE_FILES_PUBLIC parameter if present must be set to FALSE.

Rule-ID|SV-219850r879887_rule

STIG-ID|O121-BP-023900

STIG-Legacy|SV-75955

STIG-Legacy|V-61465

Vuln-ID|V-219850

O121-BP-024000 - Application object owner accounts must be disabled when not performing installation or maintenance actions.

Rule-ID|SV-219851r879887_rule

STIG-ID|O121-BP-024000

STIG-Legacy|SV-75957

STIG-Legacy|V-61467

Vuln-ID|V-219851

O121-BP-024100 - DBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.

Rule-ID|SV-219852r879887_rule

STIG-ID|O121-BP-024100

STIG-Legacy|SV-75977

STIG-Legacy|V-61487

Vuln-ID|V-219852

O121-BP-024200 - Use of the DBMS installation account must be logged.

Rule-ID|SV-219853r879887_rule

STIG-ID|O121-BP-024200

STIG-Legacy|SV-75979

STIG-Legacy|V-61489

Vuln-ID|V-219853

O121-BP-024750 - Oracle database products must be a version supported by the vendor.

CCI|CCI-002605

Rule-ID|SV-251802r879827_rule

STIG-ID|O121-BP-024750

Vuln-ID|V-251802

O121-BP-025100 - The DBMS data files, transaction logs and audit files must be stored in dedicated directories or disk partitions separate from software or other application files.

Rule-ID|SV-219861r879887_rule

STIG-ID|O121-BP-025100

STIG-Legacy|SV-76453

STIG-Legacy|V-61963

Vuln-ID|V-219861

O121-BP-025101 - The directory assigned to the AUDIT_FILE_DEST parameter must be protected from unauthorized access and must be stored in a dedicated directory or disk partition separate from software or other application files.

Rule-ID|SV-219862r879887_rule

STIG-ID|O121-BP-025101

STIG-Legacy|SV-76455

STIG-Legacy|V-61965

Vuln-ID|V-219862

O121-BP-025500 - Replication accounts must not be granted DBA privileges.

Rule-ID|SV-219866r879887_rule

STIG-ID|O121-BP-025500

STIG-Legacy|SV-76003

STIG-Legacy|V-61513

Vuln-ID|V-219866

O121-BP-025600 - Network access to the DBMS must be restricted to authorized personnel.

Detections

Analytics

Revision 1.1

Feb 12, 2024

Functional Update

Informational Update

Miscellaneous