UCF STIG Viewer Logo

DBMS account passwords should not be set to easily guessed words or values.


Overview

Finding ID Version Rule ID IA Controls Severity
V-15634 DG0127-ORACLE10 SV-24791r1_rule IAIA-1 IAIA-2 Medium
Description
DBMS account passwords set to common dictionary words or values render accounts vulnerable to password guessing attacks and unauthorized access.
STIG Date
Oracle 10 Database Instance STIG 2014-01-14

Details

Check Text ( C-29359r1_chk )
If no DBMS accounts authenticate using passwords (rare), this check is Not a Finding.

Confirm that database profiles specify a password verify function.

From SQL*Plus:

select distinct limit from dba_profiles
where resource_name= 'PASSWORD_VERIFY_FUNCTION'
order by limit;

Review the code for the password verify function or have the DBA demonstrate a password change to ensure that the function does not accept passwords that are the same as the username, the name of the database or instance name.

If reviewing code, logic similar to the following should be discovered:

-- Check if the password is too simple. A dictionary of words may be
-- maintained and a check may be made so as not to allow the words
-- that are too simple for the password.

if nls_lower(password) in
('welcome','database','account','user','password','oracle','computer','abcdefgh',
'12345') then
raise_application_error(-20002, 'Password too simple');
end if;

If any password_verify_function routines do not check for simple passwords, this is a Finding.

Check also to ensure all password-authenticated accounts specify a password_verify_function.

From SQL*Plus:

select distinct profile from dba_profiles
where resource_name='PASSWORD_VERIFY_FUNCTION'
and (limit is NULL or limit = NULL);

If any profiles are returned that are used by password-authenticated accounts, this is a Finding.

To view the names of password-authenticated accounts:

From SQL*Plus:

select name from user$ where password is not NULL;
Fix Text (F-26385r1_fix)
Define and apply a Password Verify Function for all profiles where passwords are used to authenticate accounts.

See Fix information for DG0079 to create a Password Verify Function that meets STIG requirements.