Database application user accounts should be denied storage usage for object creation within the database.

SV-24501r2_rule Database application user accounts should be denied storage usage for object creation within the database.

Vulnerability discussion

Tablespace storage quotas allow limits on storage use to be assigned to Oracle database users. Although this does not grant the user the privilege to create objects within the database, it provides an additional method to restrict unauthorized object creation and ownership.

Check content

From SQL*Plus: select username, tablespace_name from dba_ts_quotas where username not in (select distinct owner from dba_objects) and username not in (select grantee from dba_role_privs where granted_role='DBA'); Review the list of user names returned. If any belong to application users or application administrators, this is a Finding.

Fix text

Assign tablespace quotas only to database accounts authorized to create and or own objects in the database. Document authorized tablespace quotas for all accounts authorized to own objects in the System Security Plan. Remove any quotas assigned to application users, application administrators, or any other unauthorized accounts. From SQL*Plus: alter user [username] quota 0 on [tablespace name]; Replace [username] with the named user and [tablespace name] with the identified tablespace name.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.