UCF STIG Viewer Logo

The XDB Protocol server should be uninstalled if not required and authorized for use.


Overview

Finding ID Version Rule ID IA Controls Severity
V-3865 DO0420-ORACLE10 SV-24898r1_rule DCFA-1 Low
Description
The XML DB supports storage and retrieval of XML data objects in the Oracle Database. It requires the configuration of an Oracle shared-server dispatcher that is activated / used by the Oracle listener to pass http XML requests. If this service is not required, it should be uninstalled.
STIG Date
Oracle 10 Database Instance STIG 2014-01-14

Details

Check Text ( C-29454r1_chk )
From SQL*Plus:

select count(*) from dba_users where username = 'XDB';

select count(*) from v$parameter where name = 'dispatchers'
and value like '%XDB%';

If a value of 0 is returned for either the first or the second SQL statement above, this is not a Finding.

If a value of 1 (or more) is returned for the second SQL statement, review the System Security Plan to verify existence of all XML DB dispatchers is authorized.

If it is not, this is a Finding.
Fix Text (F-22835r1_fix)
If the database is authorized to support web services using XML over HTTP, then include documentation and authorization in the System Security Plan.

If not authorized, uninstall XML DB per Oracle MetaLink Note 243554.1.