O121-BP-022200 - The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.

CAT|II

CCI|CCI-000366

Rule-ID|SV-219833r533040_rule

STIG-ID|O121-BP-022200

STIG-Legacy|SV-75921

STIG-Legacy|V-61431

Vuln-ID|V-219833

O121-BP-024100 - DBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.

Rule-ID|SV-219852r401224_rule

STIG-ID|O121-BP-024100

STIG-Legacy|SV-75977

STIG-Legacy|V-61487

Vuln-ID|V-219852

O121-BP-025400 - Access to DBMS software files and directories must not be granted to unauthorized users.

Rule-ID|SV-219865r401224_rule

STIG-ID|O121-BP-025400

STIG-Legacy|SV-76001

STIG-Legacy|V-61511

Vuln-ID|V-219865

O121-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - Rules

Rule-ID|SV-219867r401224_rule

STIG-ID|O121-BP-025600

STIG-Legacy|SV-76005

STIG-Legacy|V-61515

Vuln-ID|V-219867

O121-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - tcp.invited_nodes=

O121-BP-025600 - Network access to the DBMS must be restricted to authorized personnel - tcp.validnode_checking=YES

O121-BP-026500 - Remote administration must be disabled for the Oracle connection manager.

Rule-ID|SV-219874r401224_rule

STIG-ID|O121-BP-026500

STIG-Legacy|SV-76023

STIG-Legacy|V-61533

Vuln-ID|V-219874

O121-BP-026600 - Network client connections must be restricted to supported versions - SQLNET.ALLOWED_LOGON_VERSION_CLIENT

Rule-ID|SV-219875r401224_rule

STIG-ID|O121-BP-026600

STIG-Legacy|SV-76025

STIG-Legacy|V-61535

Vuln-ID|V-219875

O121-BP-026600 - Network client connections must be restricted to supported versions - SQLNET.ALLOWED_LOGON_VERSION_SERVER

O121-C1-004500 - DBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS.

CAT|I

Rule-ID|SV-237696r667120_rule

STIG-ID|O121-C1-004500

STIG-Legacy|SV-76027

STIG-Legacy|V-61537

Vuln-ID|V-237696

O121-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CIPHER_SUITES

CCI|CCI-000186

Rule-ID|SV-220263r799974_rule

STIG-ID|O121-C1-015400

STIG-Legacy|SV-76033

STIG-Legacy|V-61543

Vuln-ID|V-220263

O121-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key - SSL_CLIENT_AUTHENTICATION

O121-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key.

O121-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - CLIENT

CCI|CCI-002421

Rule-ID|SV-237699r667129_rule

STIG-ID|O121-C1-019700

STIG-Legacy|SV-76035

STIG-Legacy|V-61545

Vuln-ID|V-237699

O121-C1-019700 - The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures - SERVER

O121-C2-001700 - The DBMS must support the disabling of network protocols deemed by the organization to be nonsecure.

CCI|CCI-000382

Rule-ID|SV-237700r822486_rule

STIG-ID|O121-C2-001700

STIG-Legacy|SV-76045

STIG-Legacy|V-61555

Vuln-ID|V-237700

O121-C2-004400 - OS accounts utilized to run external procedures called by the DBMS must have limited privileges - run_group

CCI|CCI-000381

Rule-ID|SV-237712r667168_rule

STIG-ID|O121-C2-004400

STIG-Legacy|SV-76091

STIG-Legacy|V-61601

Vuln-ID|V-237712

O121-C2-004400 - OS accounts utilized to run external procedures called by the DBMS must have limited privileges - run_user

O121-C2-011810 - Access to external executables must be disabled or restricted - 'extproc.ora EXTPROC_DLLS=ANY does not exist'

Rule-ID|SV-220288r395853_rule

STIG-ID|O121-C2-011810

STIG-Legacy|SV-76175

STIG-Legacy|V-61685

Vuln-ID|V-220288

O121-C2-011810 - Access to external executables must be disabled or restricted - 'listener.ora EXTPROC_DLLS=ANY does not exist'

O121-C2-011810 - Access to external executables must be disabled or restricted - 'run_user=nobody'

O121-C2-011810 - Access to external executables must be disabled or restricted - extproc does not exist

O121-C2-011810 - Access to external executables must be disabled or restricted - listener.ora EXTPROC is not in use

O121-C2-011810 - Access to external executables must be disabled or restricted - ORACLE_HOME/hs/admin/extproc.ora exists

O121-C2-011810 - Access to external executables must be disabled or restricted - run_group=nobody

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SQLNET.AUTHENTICATION_SERVICES

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-000767

CCI|CCI-000768

Rule-ID|SV-237723r822488_rule

STIG-ID|O121-C2-012900

STIG-Legacy|SV-76193

STIG-Legacy|V-61703

Vuln-ID|V-237723

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_CIPHER_SUITES

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_CLIENT_AUTHENTICATION

O121-C2-012900 - The DBMS must use multifactor authentication for access to user accounts - SSL_VERSION

O121-C2-014600 - The DBMS must support organizational requirements to enforce password encryption for storage.

CCI|CCI-000196

Rule-ID|SV-220290r822774_rule

STIG-ID|O121-C2-014600

STIG-Legacy|SV-76223

STIG-Legacy|V-61733

Vuln-ID|V-220290

O121-C2-015100 - DBMS passwords must not be stored in compiled, encoded, or encrypted batch jobs or compiled, encoded, or encrypted application source code.

Rule-ID|SV-237734r667234_rule

STIG-ID|O121-C2-015100

STIG-Legacy|SV-76227

STIG-Legacy|V-61737

Vuln-ID|V-237734

O121-C2-019100 - The DBMS must protect against or limit the effects of organization-defined types of Denial of Service (DoS) attacks.

CCI|CCI-002385

Rule-ID|SV-237742r667258_rule

STIG-ID|O121-C2-019100

STIG-Legacy|SV-76273

STIG-Legacy|V-61783

Vuln-ID|V-237742

O121-N1-015602 - When using command-line tools such as Oracle SQL*Plus, which can accept a plain-text password, users must use an alternative logon method that does not expose the password.

Detections

Analytics

DISA STIG Oracle 12c v2r4 Windows

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.2 Feb 6, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated. Variables updated.
Revision 1.1 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.0 May 17, 2022 Miscellaneous Metadata updated.