The Oracle SQL92_SECURITY parameter should be set to TRUE.

From Oracle Database 11g Instance STIG

Part of Oracle SQL92_SECURITY parameter

SV-24919r2_rule The Oracle SQL92_SECURITY parameter should be set to TRUE.

Vulnerability discussion

The configuration option SQL92_SECURITY specifies whether table-level SELECT privileges are required to execute an update or delete that references table column values. If this option is disabled (set to FALSE), the UPDATE privilege can be used to determine values that should require SELECT privileges.

Check content

From SQL*Plus: select value from v$parameter where name = 'sql92_security'; If the value returned is set to FALSE, this is a Finding. If the parameter is set to TRUE or does not exist, this is Not a Finding.

Fix text

Enable SQL92 security. From SQL*Plus: alter system set sql92_security = TRUE scope = spfile; The above SQL*Plus command will set the parameter to take effect at next system startup.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer