UCF STIG Viewer Logo

The Oracle WITH GRANT OPTION privilege should not be granted to non-DBA or non-Application administrator user accounts.


Overview

Finding ID Version Rule ID IA Controls Severity
V-2533 DO3451-ORACLE10 SV-24904r2_rule ECLP-1 Medium
Description
An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged account exploitation. Application user accounts should never require WITH GRANT OPTION privileges since, by definition, they require only privileges to execute procedures or view / edit data.
STIG Date
Oracle Database 10g Instance STIG 2014-04-02

Details

Check Text ( C-29462r2_chk )
From SQL*Plus: select grantee||': '||owner||'.'||table_name from dba_tab_privs where grantable = 'YES' and owner not in (select distinct owner from dba_objects) and grantee not in (select grantee from dba_role_privs where granted_role = 'DBA') order by grantee; If any accounts are listed, this is a Finding.
Fix Text (F-26524r1_fix)
Revoke privileges granted the WITH GRANT OPTION from non-DBA and accounts that do not own application objects. Re-grant privileges without specifying WITH GRANT OPTION.