Oracle Configuration Manager should not remain installed on a production system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-16056	DO6754-ORACLE11	SV-24963r1_rule	ECAN-1	Medium

Description
Oracle Configuration Manager (OCM) is a function of the Oracle Software Configuration Manager (SCM). OCM collects system configuration data used for automated upload to systems owned and managed by Oracle to assist in providing customer support. The configuration information about the server that the OCM collects includes IP addresses, hostname, database username, location of datafiles, etc.

STIG	Date
Oracle Database 11g Installation STIG	2014-04-02

Details

Check Text ( C-29496r1_chk )
NOTE: The collection does not include application or custom data within the database. If released to unauthorized persons, system configuration data may be used by malicious persons to gain additional unauthorized access to the database or other systems. On UNIX Systems: ls $ORACLE_HOME/ccr On Windows Systems (From Windows Explorer): Browse to the %ORACLE_HOME% directory. If the directory ORACLE_HOME\ccr does not exist, this is not a Finding. If the ccr directory exists, confirm if any of the Oracle databases have been configured for OCM: From SQL*Plus: select username from dba_users where username = 'ORACLE_OCM'; If the account exists, OCM has been installed (on this database) and is a Finding.

Check Text ( C-29496r1_chk )

NOTE: The collection does not include application or custom data within the database. If released to unauthorized persons, system configuration data may be used by malicious persons to gain additional unauthorized access to the database or other systems.

On UNIX Systems:

ls $ORACLE_HOME/ccr

On Windows Systems (From Windows Explorer):

Browse to the %ORACLE_HOME% directory.

If the directory ORACLE_HOME\ccr does not exist, this is not a Finding.

If the ccr directory exists, confirm if any of the Oracle databases have been configured for OCM:

From SQL*Plus:

select username from dba_users where username = 'ORACLE_OCM';

If the account exists, OCM has been installed (on this database) and is a Finding.

Fix Text (F-26564r1_fix)
Remove Oracle Configuration Manager. Details for removal are provided in Oracle MetaLink Note 369111.1 or in MetaLink Note 728989.1 for a link to the OCM Installation and Administration Guide.