Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-3865 | DO0420-ORACLE10 | SV-24898r1_rule | DCFA-1 | Low |
Description |
---|
The XML DB supports storage and retrieval of XML data objects in the Oracle Database. It requires the configuration of an Oracle shared-server dispatcher that is activated / used by the Oracle listener to pass http XML requests. If this service is not required, it should be uninstalled. |
STIG | Date |
---|---|
Oracle 10 Database Instance STIG | 2014-01-14 |
Check Text ( C-29454r1_chk ) |
---|
From SQL*Plus: select count(*) from dba_users where username = 'XDB'; select count(*) from v$parameter where name = 'dispatchers' and value like '%XDB%'; If a value of 0 is returned for either the first or the second SQL statement above, this is not a Finding. If a value of 1 (or more) is returned for the second SQL statement, review the System Security Plan to verify existence of all XML DB dispatchers is authorized. If it is not, this is a Finding. |
Fix Text (F-22835r1_fix) |
---|
If the database is authorized to support web services using XML over HTTP, then include documentation and authorization in the System Security Plan. If not authorized, uninstall XML DB per Oracle MetaLink Note 243554.1. |