4.2.1 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_SYS_SQL'

Information

As use of the DBMS_SYS_SQL package could allow an user to run code as a different user without entering user credentials.

Solution

To remediate this setting execute the following SQL statement. REVOKE EXECUTE ON DBMS_SYS_SQL FROM PUBLIC;

See Also

https://workbench.cisecurity.org/files/601

Item Details

Audit Name: CIS Oracle Server 11g R2 DB v2.2.0

Plugin: OracleDB

Control ID: 440946bb6f2d1099452b398c7b3e362b4dc014ae65bc3e5223ba1ef18de3af8b