4.2 Ensure All Sample Data And Users Have Been Removed

Information

Oracle sample schemas can be used to create sample users (BI,HR,IX,OE,PM,SCOTT,SH), with well-known default passwords, particular views, and procedures/functions, in addition to tables and fictitious data. The sample schemas should be removed.

Rationale:

The sample schemas are typically not required for production operations of the database. The default users, views, and/or procedures/functions created by sample schemas could be used to launch exploits against production environments.

Solution

To remediate this setting, execute the following SQL statement, keeping in mind if this is granted in both container and pluggable database, you must connect to both places to run the drop script.

$ORACLE_HOME/demo/schema/drop_sch.sql

Then, execute the following SQL statement.

DROP USER SCOTT CASCADE;

Note: The recyclebin is not set to OFF within the default drop script, which means that the data will still be present in your environment until the recyclebin is emptied.

Impact:

The Oracle sample usernames may be in use on a production basis. It is important that you first verify that BI, HR, IX, OE, PM, SCOTT, and/or SH are not valid production usernames before executing the dropping SQL scripts. This may be particularly true with the HR and BI users. If any of these users are present, it is important to be cautious and confirm the schemas present are, in fact, Oracle sample schemas and not production schemas being relied upon by business operations.

References:

http://docs.oracle.com/database/121/COMSC/toc.htm

See Also

https://workbench.cisecurity.org/files/2741