The XDB Protocol server should be uninstalled if not required and authorized for use.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3865	DO0420-ORACLE10	SV-24898r1_rule	DCFA-1	Low

Description
The XML DB supports storage and retrieval of XML data objects in the Oracle Database. It requires the configuration of an Oracle shared-server dispatcher that is activated / used by the Oracle listener to pass http XML requests. If this service is not required, it should be uninstalled.

STIG	Date
Oracle Database 10g Instance STIG	2014-04-02

Details

Check Text ( C-29454r1_chk )
From SQLPlus: select count() from dba_users where username = 'XDB'; select count(*) from v$parameter where name = 'dispatchers' and value like '%XDB%'; If a value of 0 is returned for either the first or the second SQL statement above, this is not a Finding. If a value of 1 (or more) is returned for the second SQL statement, review the System Security Plan to verify existence of all XML DB dispatchers is authorized. If it is not, this is a Finding.

Check Text ( C-29454r1_chk )

From SQL*Plus: select count(*) from dba_users where username = 'XDB'; select count(*) from v$parameter where name = 'dispatchers' and value like '%XDB%'; If a value of 0 is returned for either the first or the second SQL statement above, this is not a Finding. If a value of 1 (or more) is returned for the second SQL statement, review the System Security Plan to verify existence of all XML DB dispatchers is authorized. If it is not, this is a Finding.

Fix Text (F-22835r1_fix)
If the database is authorized to support web services using XML over HTTP, then include documentation and authorization in the System Security Plan. If not authorized, uninstall XML DB per Oracle MetaLink Note 243554.1.