Detections
Analytics

4.4.1 Restrict Access to SYSIBMADM.AUTHORIZATIONIDS

Information

Administrative views and routines provide additional information and functionality beyond that in the database catalogs. Many of these view and routines have SELECT and EXECUTE granted to PUBLIC. Security sensitive views and routines should be restricted to authorized users only.

Rationale:

Databases created without the RESTRICT option automatically GRANT the SELECT privilege to PUBLIC for administrative views. Therefore, it is strongly recommended to explicitly REVOKE the SELECT privilege on the SYSIBMADM.AUTHORIZATIONIDS view from PUBLIC to reduce the risk a malicious user may use this view to conduct information gathering regarding the users that are known to the database server.

Solution

Perform the following to revoke access from PUBLIC.

Connect to the Db2 database.

db2 => connect to <dbname>

Run the following command:

db2 => REVOKE SELECT ON SYSIBMADM.AUTHORIZATIONIDS FROM PUBLIC

See Also

https://workbench.cisecurity.org/benchmarks/23492

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: IBM_DB2DB

Control ID: 2a98fdd9e7d7494e5631e044f2805d9d1635994b39494f0d402a8bb4dcde1bcf