Detections
Analytics

6.6.1 Ensure Proxy User Privileges Are Revoked from Unauthorized 'GRANTEE'

Information

Oracle Database supports proxy user authentication, which allows a client user to connect to the database as a proxy user.

An Oracle user with the right to connect to the database as a proxy user inherits the authorizations and roles of the client.

For example, the user DUMMYUSER can log on as SYSTEM and then use its DBA role:

ALTER USER SYSTEM GRANT CONNECT THROUGH DUMMYUSER;

Solution

To remediate this recommendation, execute the following SQL statement.

ALTER USER <CLIENT_USER> REVOKE CONNECT THROUGH <PROXY_USER>;

See Also

https://workbench.cisecurity.org/benchmarks/26139

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: OracleDB

Control ID: 371575a59c50756bde076b1b0ce51f84e9bbbe3d6cac8ddd5f422099a5cda0c4