DG0119-ORACLE11 - DBMS application users should not be granted administrative privileges to the DBMS.

Information

Excessive privileges can lead to unauthorized actions on data and database objects. Assigning only the privileges required to perform the job function authorized for the user helps protect against exploits against application vulnerabilities such as SQL injection attacks. The recommended method is to grant access only to stored procedures that perform only static actions on the data authorized for the user. Where this is not feasible, consider using data views or other methods to restrict users to only the data suitable for their job function.

Solution

Revoke ALTER, REFERENCES, and INDEX privileges from application user roles.

From SQL*Plus:
revoke [privilege] from [application user role];

Replace [privilege] with the identified ALTER, REFERENCES or INDEX privilege and [application user role] with the identified application role.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, CAT|II, Rule-ID|SV-24746r2_rule, STIG-ID|DG0119-ORACLE11, Vuln-ID|V-15628

Plugin: OracleDB

Control ID: 8675e2c7863283fefd1d3a62120a4795f198fab419d83850bee64ad1f81b34e8