Detections
Analytics

DO3539-ORACLE11 - The Oracle REMOTE_OS_ROLES parameter should be set to FALSE - 'remote_os_roles = false'

Information

Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is set to TRUE, a remote user could impersonate another operating system user over a network connection.

Solution

Document remote OS roles in the System Security Plan.

If not required, disable use of remote OS roles.

From SQL*Plus:

 alter system set remote_os_roles = FALSE scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

References: CAT|I, Rule-ID|SV-24916r2_rule, STIG-ID|DO3539-ORACLE11, Vuln-ID|V-2555

Plugin: OracleDB

Control ID: 022ebfe026bab0a605028e2592f3a7bb240159c8dab8f1bf77661b1e6fa72b7b