O121-BP-022600 - Object permissions granted to PUBLIC must be restricted.

Information

Permissions on objects may be granted to the user group PUBLIC. Because every database user is a member of the PUBLIC group, granting object permissions to PUBLIC gives all users in the database access to that object. In a secure environment, granting object permissions to PUBLIC must be restricted to those objects that all users are allowed to access. The policy does not require object permissions assigned to PUBLIC by the installation of Oracle Database server components be revoked.

Solution

Revoke any privileges granted to PUBLIC for objects that are not owned by Oracle product accounts.

From SQL*Plus:

revoke [privilege name] from [user name] on [object name];

Assign permissions to custom application user roles based on job functions:

From SQL*Plus:

grant [privilege name] to [user role] on [object name];

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_12c_V2R9_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-219837r879887_rule, STIG-ID|O121-BP-022600, STIG-Legacy|SV-75929, STIG-Legacy|V-61439, Vuln-ID|V-219837

Plugin: OracleDB

Control ID: ac4504b91022c278120e3e3a6c01af962262d39d77400bea2479ffe0deeb03c2