4.2.38 Restrict Access to SYSCAT.TABAUTH

Information

The SYSCAT.TABAUTH view contains users or groups that have been granted one or more privileges on a table or view. It is recommended that the PUBLIC role be restricted from accessing this view.

Rationale:

PUBLIC should not have access to the grants of views and tables in a database. This could lead to an exploit.

Solution

Perform the following to revoke access from PUBLIC.

Connect to the Db2 database.

db2 => connect to <dbname>

Run the following command:

db2 => REVOKE SELECT ON SYSCAT.TABAUTH FROM PUBLIC

See Also

https://workbench.cisecurity.org/benchmarks/10752

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: IBM_DB2DB

Control ID: e20e942a5c24a3af234be1658a94dc16992efc41814d9df2437a763e7e3a120b