Access to external objects should be disabled if not required and authorized.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15617	DG0098-ORACLE10	SV-24693r1_rule	DCFA-1	Medium

Description
The UTL_FILE package allows host file access from within the database using the permissions and privileges assigned to the Oracle database process or service. This package should be used with caution. All files accessible to using this package is equally accessible to any database user with execute permissions to the UTL_FILE package. When UTL_FILE_DIR is set to “*”, all directories accessible to the Oracle database process, typically the Oracle installation account, are accessible via the UTL_FILE package. This setting effectively turns off directory access checking, and makes any directory accessible to the UTL_FILE functions. The UTL_FILE_DIR list should specify only authorized and protected directories and should include only fully specified path names.

Description

The UTL_FILE package allows host file access from within the database using the permissions and privileges assigned to the Oracle database process or service. This package should be used with caution. All files accessible to using this package is equally accessible to any database user with execute permissions to the UTL_FILE package. When UTL_FILE_DIR is set to “*”, all directories accessible to the Oracle database process, typically the Oracle installation account, are accessible via the UTL_FILE package. This setting effectively turns off directory access checking, and makes any directory accessible to the UTL_FILE functions. The UTL_FILE_DIR list should specify only authorized and protected directories and should include only fully specified path names.

STIG	Date
Oracle 10 Database Instance STIG	2014-01-14

Details

Check Text ( C-914r1_chk )
From SQLPlus: select value from v$parameter where name='utl_file_dir'; If the returned value contains '', this is a Finding.

Fix Text (F-2592r1_fix)
Where its use is authorized, restrict access by a database session to external host files. From SQLPlus: alter system set utl_file_dir=[authorized directory] scope=spfile; Replace [authorized directory] with the directory path where file access and storage is authorized. Review Oracle MetaLink Note 39037.1 if you need to define multiple authorized directories. The above SQLPlus command will set the parameter to take effect at next system startup.

Fix Text (F-2592r1_fix)

Where its use is authorized, restrict access by a database session to external host files.

From SQL*Plus:
alter system set utl_file_dir=[authorized directory] scope=spfile;

Replace [authorized directory] with the directory path where file access and storage is authorized.

Review Oracle MetaLink Note 39037.1 if you need to define multiple authorized directories.

The above SQL*Plus command will set the parameter to take effect at next system startup.