The Oracle SQL92_SECURITY parameter should be set to TRUE.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2556	DO3540-ORACLE11	SV-24919r2_rule		Medium

Description
The configuration option SQL92_SECURITY specifies whether table-level SELECT privileges are required to execute an update or delete that references table column values. If this option is disabled (set to FALSE), the UPDATE privilege can be used to determine values that should require SELECT privileges.

STIG	Date
Oracle Database 11g Instance STIG	2017-06-29

Details

Check Text ( C-29471r2_chk )
From SQL*Plus: select value from v$parameter where name = 'sql92_security'; If the value returned is set to FALSE, this is a Finding. If the parameter is set to TRUE or does not exist, this is Not a Finding.

Fix Text (F-26535r1_fix)
Enable SQL92 security. From SQL*Plus: alter system set sql92_security = TRUE scope = spfile; The above SQL*Plus command will set the parameter to take effect at next system startup.