Detections
Analytics

1.39 O19C-00-010100

Information

Oracle application administration roles must be disabled if not required and authorized.

GROUP ID: V-270533
RULE ID: SV-270533r1065215

Application administration roles, which are assigned system or elevated application object privileges, must be protected from default activation. Application administration roles are determined by system privilege assignment ( create / alter / drop user ) and application user role ADMIN OPTION privileges.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

For each role assignment returned, issue:

From SQL*Plus:

alter user [username] default role all except [role];

If the user has more than one application administration role assigned, then remove assigned roles from default assignment and assign individually the appropriate default roles.

See Also

https://workbench.cisecurity.org/benchmarks/26166

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-270533r1065215_rule, STIG-ID|O19C-00-010100, Vuln-ID|V-270533

Plugin: OracleDB

Control ID: d2d91c47667b486cc89c1421382a1e81d842c85bddb2d8faf9fb26a36d75bcff