UCF STIG Viewer Logo

OHS must not have the directive PlsqlDatabasePassword set in clear text.


Overview

Finding ID Version Rule ID IA Controls Severity
V-221471 OH12-1X-000234 SV-221471r415098_rule High
Description
OHS supports the use of the module mod_plsql, which allows applications to be hosted that are PL/SQL-based. To access the database, the module must have a valid username, password and database name. To keep the password from an attacker, the password must not be stored in plain text, but instead, obfuscated.
STIG Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide 2021-12-29

Details

Check Text ( C-23186r415096_chk )
1. As required, open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf and every .conf file (e.g., dads.conf) included in it with an editor.

2. Search for the "PlsqlDatabasePassword" directive.

3. If the directive is set in clear text, this is a finding.
Fix Text (F-23175r415097_fix)
1. At shell prompt, set "ORACLE_HOME" environment variable to $ORACLE_HOME location and export the variable.

2. At shell prompt, set "PATH" environment variable to "$ORACLE_HOME/ohs/bin:$ORACLE_HOME/bin:$ORACLE_HOME/perl/bin:$PATH" and export the variable.

3a. If AIX OS, at shell prompt, set "LIBPATH" environment variable to "$ORACLE_HOME/lib:$LIBPATH" and export the variable.
3b. If HP-UX OS, at shell prompt, set "SHLIB_PATH" environment variable to "$ORACLE_HOME/lib:$SHLIB_PATH" and export the variable.
3c. If Solaris OS, at shell prompt, set "LD_LIBRARY_PATH" environment variable to "$ORACLE_HOME/lib32:$LD_LIBRARY_PATH" and export the variable.
3d. If Linux or Other Unix OS, at shell prompt, set "LD_LIBRARY_PATH" environment variable to "$ORACLE_HOME/lib:$LD_LIBRARY_PATH" and export the variable.

4. Change the present working directory to "$ORACLE_HOME/ohs/bin" (e.g., cd $ORACLE_HOME/ohs/bin).

5. For each .conf file found to be at fault, execute dadTool.pl script (e.g., "perl dadTool.pl -f $DOMAIN_HOME/config/fmwconfig/compoennts/OHS//mod_plsql/dads.conf").