ccess to external objects should be disabled if not required and authorized.

Part of DBMS access to external local objects

SV-24694r1_rule ccess to external objects should be disabled if not required and authorized.

Vulnerability discussion

The UTL_FILE package allows host file access from within the database using the permissions and privileges assigned to the Oracle database process or service. This package should be used with caution. All files accessible to using this package is equally accessible to any database user with execute permissions to the UTL_FILE package. When UTL_FILE_DIR is set to “*”, all directories accessible to the Oracle database process, typically the Oracle installation account, are accessible via the UTL_FILE package. This setting effectively turns off directory access checking, and makes any directory accessible to the UTL_FILE functions. The UTL_FILE_DIR list should specify only authorized and protected directories and should include only fully specified path names.

Check content

From SQL*Plus: select value from v$parameter where name='utl_file_dir'; If the returned value contains '*', this is a Finding.

Fix text

Where its use is authorized, restrict access by a database session to external host files. From SQL*Plus: alter system set utl_file_dir=[authorized directory] scope=spfile; Replace [authorized directory] with the directory path where file access and storage is authorized. Review Oracle MetaLink Note 39037.1 if you need to define multiple authorized directories. The above SQL*Plus command will set the parameter to take effect at next system startup.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.