Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Oracle SQL92_SECURITY parameter should be set to TRUE.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-2556 | DO3540-ORACLE11 | SV-24919r2_rule | Medium |
| Description |
|---|
| The configuration option SQL92_SECURITY specifies whether table-level SELECT privileges are required to execute an update or delete that references table column values. If this option is disabled (set to FALSE), the UPDATE privilege can be used to determine values that should require SELECT privileges. |
| STIG | Date |
|---|---|
| Oracle Database 11g Instance STIG | 2016-12-14 |
Details
| Check Text ( C-29471r2_chk ) |
|---|
| From SQL*Plus: select value from v$parameter where name = 'sql92_security'; If the value returned is set to FALSE, this is a Finding. If the parameter is set to TRUE or does not exist, this is Not a Finding. |
| Fix Text (F-26535r1_fix) |
|---|
| Enable SQL92 security. From SQL*Plus: alter system set sql92_security = TRUE scope = spfile; The above SQL*Plus command will set the parameter to take effect at next system startup. |