DG0098-ORACLE11 - ccess to external objects should be disabled if not required and authorized - 'utl_file_dir does not include *'

Information

The UTL_FILE package allows host file access from within the database using the permissions and privileges assigned to the Oracle database process or service. This package should be used with caution. All files accessible to using this package is equally accessible to any database user with execute permissions to the UTL_FILE package. When UTL_FILE_DIR is set to '*', all directories accessible to the Oracle database process, typically the Oracle installation account, are accessible via the UTL_FILE package. This setting effectively turns off directory access checking, and makes any directory accessible to the UTL_FILE functions. The UTL_FILE_DIR list should specify only authorized and protected directories and should include only fully specified path names.

Solution

Where its use is authorized, restrict access by a database session to external host files.

From SQL*Plus:
alter system set utl_file_dir=[authorized directory] scope=spfile;

Replace [authorized directory] with the directory path where file access and storage is authorized.

Review Oracle MetaLink Note 39037.1 if you need to define multiple authorized directories.

The above SQL*Plus command will set the parameter to take effect at next system startup.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CAT|II, Rule-ID|SV-24694r1_rule, STIG-ID|DG0098-ORACLE11, Vuln-ID|V-15617

Plugin: OracleDB

Control ID: 92bca544ca2bac697d83526e3d64d9e2e336fe9857e2df1bf6c8ae1f3d85e982