Detections
Analytics

DO6752-ORACLE11 - The Oracle SEC_PROTOCOL_ERROR_TRACE_ACTION parameter should not be set to NONE.

Information

Undetected attacks using bad packets can lead to a successful Denial of Service (DoS) to database clients. Notification of attacks based on a flood of bad packets sent to the database can assist in discovery and response to this type of attack.

Solution

Set the value for the sec_protocol_error_trace_action initialization parameter to ALERT or LOG.

TRACE may be appropriate for testing or development, but provides more detail than may be useful.

Consider using ALERT for MAC 1 systems.

From SQL*Plus:

 alter system set sec_protocol_error_trace_action = 'ALERT' scope = spfile;
 OR
 alter system set sec_protocol_error_trace_action = 'LOG' scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

References: CAT|II, Rule-ID|SV-24959r2_rule, STIG-ID|DO6752-ORACLE11, Vuln-ID|V-16054

Plugin: OracleDB

Control ID: 8189a59a20a9f648f7b89dd346258d70bec70445ee8ce3a72d22d700e3d8a12e