O112-BP-021300 - Oracle instance names must not contain Oracle version numbers.

Information

Service names may be discovered by unauthenticated users. If the service name includes version numbers or other database product information, a malicious user may use that information to develop a targeted attack.

Solution

Follow the instructions in Oracle MetaLink Note 15390.1 (and related documents) to change the SID for the database without re-creating the database to a value that does not identify the Oracle version.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11-2g_V2R4_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-219696r879887_rule, STIG-ID|O112-BP-021300, STIG-Legacy|SV-68203, STIG-Legacy|V-53963, Vuln-ID|V-219696

Plugin: OracleDB

Control ID: 22eb29bad7799dd0c2e2173768bd4ff693e1d3c78e9a9919bbf80ea05e67016c