The DBMS must check the validity of data inputs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32555	SRG-APP-000251-DB-000160	SV-42892r1_rule		Medium

Description
Invalid user input occurs when a user inserts data or characters into an applications data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. All applications need to validate the data users attempt to input to the application for processing. Rules for checking the valid syntax and semantics of information system inputs (e.g., character set, length, numerical range, acceptable values) are in place to verify inputs match specified definitions for format and content. Inputs passed to interpreters are prescreened to prevent the content from being unintentionally interpreted as commands.

Description

Invalid user input occurs when a user inserts data or characters into an applications data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. All applications need to validate the data users attempt to input to the application for processing. Rules for checking the valid syntax and semantics of information system inputs (e.g., character set, length, numerical range, acceptable values) are in place to verify inputs match specified definitions for format and content. Inputs passed to interpreters are prescreened to prevent the content from being unintentionally interpreted as commands.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40994r2_chk )
Review DBMS code, settings, field definitions, and constraints to determine whether or not data being input into the database is valid. If code exists that allows invalid data to be acted upon or input into the database, this is a finding. If field definitions do not exist in the database, this is a finding. If fields do not contain constraints where required, this is a finding.

Fix Text (F-36470r2_fix)
Modify database code to properly validate data before it is put into the database or acted upon by the database. Modify database to contain field definitions for each field in the database. Modify database to contain constraints on database columns and tables that require them for data validity.