Object permissions granted to PUBLIC must be restricted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-53989	O112-BP-022600	SV-68229r3_rule		Medium

Description
Permissions on objects may be granted to the user group PUBLIC. Because every database user is a member of the PUBLIC group, granting object permissions to PUBLIC gives all users in the database access to that object. In a secure environment, granting object permissions to PUBLIC should be restricted to those objects that all users are allowed to access. The policy does not require object permissions assigned to PUBLIC by the installation of Oracle Database server components to be revoked (with the exception of the packages listed in O112-BP-021800).

Description

Permissions on objects may be granted to the user group PUBLIC. Because every database user is a member of the PUBLIC group, granting object permissions to PUBLIC gives all users in the database access to that object. In a secure environment, granting object permissions to PUBLIC should be restricted to those objects that all users are allowed to access. The policy does not require object permissions assigned to PUBLIC by the installation of Oracle Database server components to be revoked (with the exception of the packages listed in O112-BP-021800).

STIG	Date
Oracle Database 11.2g Security Technical Implementation Guide	2017-04-05

Details

Check Text ( C-54779r4_chk )
Run the SQL query: select owner \|\|'.'\|\| table_name \|\|':'\|\| privilege from dba_tab_privs where grantee = 'PUBLIC' and owner not in (); (With respect to the list of special accounts that are excluded from this requirement, it is expected that the DBA will maintain the list to suit local circumstances, adding special accounts as necessary and removing any that are not supposed to be in use in the Oracle deployment that is under review.) If any records that are not Oracle product accounts are returned, are not documented and authorized, this is a Finding. NOTE: This check may return false positives where other Oracle product accounts are not included in the exclusion list.

Check Text ( C-54779r4_chk )

Run the SQL query:

select owner ||'.'|| table_name ||':'|| privilege from dba_tab_privs
where grantee = 'PUBLIC'
and owner not in
();

(With respect to the list of special accounts that are excluded from this requirement, it is expected that the DBA will maintain the list to suit local circumstances, adding special accounts as necessary and removing any that are not supposed to be in use in the Oracle deployment that is under review.)

If any records that are not Oracle product accounts are returned, are not documented and authorized, this is a Finding.

NOTE: This check may return false positives where other Oracle product accounts are not included in the exclusion list.

Fix Text (F-58829r1_fix)
Revoke any privileges granted to PUBLIC for objects that are not owned by Oracle product accounts. From SQLPlus: revoke [privilege name] from [user name] on [object name]; Assign permissions to custom application user roles based on job functions: From SQLPlus: grant [privilege name] to [user role] on [object name];