Detections
Analytics

6.6.1 Ensure Proxy User Privileges Are Revoked From Unauthorized 'GRANTEE'

Information

Oracle Database supports proxy user authentication, which allows a client user to connect to the database as a proxy user.

An Oracle user with the right to connect to the database as a proxy user inherits the authorizations and roles of the client.

For example, the user DUMMYUSER can log on as SYSTEM and then use its DBA role:

ALTER USER SYSTEM GRANT CONNECT THROUGH DUMMYUSER;

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate this recommendation, execute the following SQL statement.

ALTER USER <CLIENT_USER> REVOKE CONNECT THROUGH <PROXY_USER>;

See Also

https://workbench.cisecurity.org/benchmarks/23897

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: OracleDB

Control ID: d07c985003cfd948d140ef10d355634d05135f29beb4ad478276a5a2dfc55152