Detections
Analytics

O19C-00-009000 - The Oracle WITH GRANT OPTION privilege must be limited when granted to nondatabase administrator (DBA) or nonapplication administrator user accounts.

Information

Specifying WITH GRANT OPTION enables the grantee to grant the object privileges to other users and roles. An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged account exploitation. Application user accounts limit WITH GRANT OPTION privileges since, by definition, they require only privileges to execute procedures or view/edit data.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Revoke privileges granted the WITH GRANT OPTION from non-DBA and accounts that do not own application objects or document the need for WITH GRANT OPTION and get approval.

Re-grant privileges without specifying WITH GRANT OPTION.

Note: Do not revoke the system-generated grants such as those found on SYS_PLSQL_% objects. They are system generated object types (aka ShadowTypes), created internally by Oracle when using the Pipelined Table Functions. This can result in (incorrect) compilation failures and/or invalidations when the users who are supposed to have access to the shadow types find themselves without access.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_19c_V1R5_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-270523r1167746_rule, STIG-ID|O19C-00-009000, Vuln-ID|V-270523

Plugin: OracleDB

Control ID: ba6c94354bc23c1c8a3c7f1c18a7df9325f7556092ef2dde4b69912ed509702d