Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Oracle instance names must not contain Oracle version numbers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-219825 | O121-BP-021300 | SV-219825r533016_rule | Medium |
| Description |
|---|
| Service names may be discovered by unauthenticated users. If the service name includes version numbers or other database product information, a malicious user may use that information to develop a targeted attack. |
| STIG | Date |
|---|---|
| Oracle Database 12c Security Technical Implementation Guide | 2022-11-29 |
Details
| Check Text ( C-21536r533014_chk ) |
|---|
| From SQL*Plus: select instance_name from v$instance; select version from v$instance; If the instance name returned references the Oracle release number, this is a finding. Numbers used that include version numbers by coincidence are not a finding. The DBA should be able to relate the significance of the presence of a digit in the SID. |
| Fix Text (F-21535r533015_fix) |
|---|
| Follow the instructions in Oracle MetaLink Note 15390.1 (and related documents) to change the SID for the database without re-creating the database to a value that does not identify the Oracle version. |