Detections
Analytics

4.2.32 Restrict Access to SYSCAT.SCHEMAAUTH

Information

The SYSCAT.SCHEMAAUTH view contains a list of all users that have one or more privileges or access to a particular schema. It is recommended that the PUBLIC role be restricted from accessing this view.

Rationale:

PUBLIC should not have access to see all the users because this could be used as a point of exploit.

Solution

Perform the following to revoke access from PUBLIC.

Connect to the Db2 database.

db2 => connect to <dbname>

Run the following command:

db2 => REVOKE SELECT ON SYSCAT.SCHEMAAUTH FROM PUBLIC

See Also

https://workbench.cisecurity.org/benchmarks/23492

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: IBM_DB2DB

Control ID: 8ae56782cd3361d51b0b814903780e3d7da2d5d75b6c61266b284a78edb9c4aa