DO0340-ORACLE11 - Oracle application administration roles should be disabled if not required and authorized.

Information

Application administration roles, which are assigned system or elevated application object privileges, should be protected from default activation. Application administration roles are determined by system privilege assignment (create / alter / drop user) and application user role ADMIN OPTION privileges.

Solution

For each role assignment returned, issue:

From SQL*Plus:

alter user [username] default role all except [role];

If the user has more than one application administration role assigned, then you will have to remove assigned roles from default assignment and assign individually the appropriate default roles.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CAT|II, Rule-ID|SV-24531r2_rule, STIG-ID|DO0340-ORACLE11, Vuln-ID|V-3438

Plugin: OracleDB

Control ID: bfe710c7f6a4ded942d0b439ee530f36373c436781a8855beb27f9cfb4d44a11