The Oracle SEC_PROTOCOL_ERROR_TRACE_ACTION parameter should not be set to NONE.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-16054	DO6752-ORACLE11	SV-24959r2_rule	ECAT-1 ECAT-2	Medium

Description
Undetected attacks using bad packets can lead to a successful Denial of Service (DoS) to database clients. Notification of attacks based on a flood of bad packets sent to the database can assist in discovery and response to this type of attack.

STIG	Date
Oracle Database 11g Installation STIG	2014-12-16

Details

Check Text ( C-26576r3_chk )
From SQL*Plus: select value from v$parameter where name = 'sec_protocol_error_trace_action'; If the value returned is NONE, this is a Finding. If the value returned is TRACE, LOG or ALERT, this is Not a Finding.

Fix Text (F-22866r1_fix)
Set the value for the sec_protocol_error_trace_action initialization parameter to ALERT or LOG. TRACE may be appropriate for testing or development, but provides more detail than may be useful. Consider using ALERT for MAC 1 systems. From SQLPlus: alter system set sec_protocol_error_trace_action = 'ALERT' scope = spfile; OR alter system set sec_protocol_error_trace_action = 'LOG' scope = spfile; The above SQLPlus command will set the parameter to take effect at next system startup.

Fix Text (F-22866r1_fix)

Set the value for the sec_protocol_error_trace_action initialization parameter to ALERT or LOG.

TRACE may be appropriate for testing or development, but provides more detail than may be useful.

Consider using ALERT for MAC 1 systems.

From SQL*Plus:

alter system set sec_protocol_error_trace_action = 'ALERT' scope = spfile;
OR
alter system set sec_protocol_error_trace_action = 'LOG' scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.