Fixed user and public database links should be authorized for use.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2520	DO0250-ORACLE11	SV-24519r2_rule		Medium

Description
Database links define connections that may be used by the local database to access remote Oracle databases. These links provide a means for a compromise to the local database to spread to remote databases in the distributed database environment. Limiting or eliminating use of database links where they are not required to support the operational system can help isolate compromises to the local or a limited number of databases.

Description

Database links define connections that may be used by the local database to access remote Oracle databases. These links provide a means for a compromise to the local database to spread to remote databases in the distributed database environment. Limiting or eliminating use of database links where they are not required to support the operational system can help isolate compromises to the local or a limited number of databases.

STIG	Date
Oracle Database 11g Instance STIG	2017-06-29

Details

Check Text ( C-29437r2_chk )
From SQLPlus: select owner\|\|': '\|\|db_link from dba_db_links; select count() from sys.dba_repcatlog; If no records are returned from the first SQL statement, this check is Not a Finding. If the value of the count returned is 0 for the second SQL statement, none of the database links listed above, if any, is used for replication. Confirm the public and fixed user database links listed are documented in the System Security Plan, are authorized by the IAO and are used for replication or operational system requirements. If any are not, this is a Finding.

Check Text ( C-29437r2_chk )

From SQL*Plus:

select owner||': '||db_link from dba_db_links;
select count(*) from sys.dba_repcatlog;

If no records are returned from the first SQL statement, this check is Not a Finding.

If the value of the count returned is 0 for the second SQL statement, none of the database links listed above, if any, is used for replication.

Confirm the public and fixed user database links listed are documented in the System Security Plan, are authorized by the IAO and are used for replication or operational system requirements.

If any are not, this is a Finding.

Fix Text (F-26494r1_fix)
Document all authorized connections from the database to remote databases in the System Security Plan. Remove all unauthorized remote database connection definitions from the database. From SQL*Plus: drop database link [link name]; OR drop public database link [link name]; Review remote database connection definitions periodically and confirm their use is still required and authorized.