STIGQter STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Default demonstration and sample databases, database objects, and applications must be removed.

DISA Rule

SV-219768r395853_rule

Vulnerability Number

V-219768

Group Title

SRG-APP-000141-DB-000090

Rule Version

O112-C2-011500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Remove any demonstration and sample databases, database applications, objects, and files from the DBMS.

To remove an account and all objects owned by that account (using BI as an example):
DROP USER BI CASCADE;

To remove objects without removing their owner, use the appropriate DROP statement (DROP TABLE, DROP VIEW, etc.).

Check Contents

If Oracle is hosted on a server that does not support production systems, and is designated for the deployment of samples and demonstrations, this is not applicable (NA).

Review documentation and websites from Oracle and any other relevant vendors for vendor-provided demonstration or sample databases, database applications, schemas, objects, and files.

Review the Oracle DBMS to determine if any of the demonstration and sample databases, schemas, database applications, or files are installed in the database or are included with the DBMS application. If any are present in the database or are included with the DBMS application, this is a finding.

The Oracle Default Sample Schema User Accounts are:

BI
Owns the Business Intelligence schema included in the Oracle Sample Schemas.

HR
Manages the Human Resources schema. Schema stores information about the employees and the facilities of the company.

OE
Manages the Order Entry schema. Schema stores product inventories and sales of the company's products through various channels.

PM
Manages the Product Media schema. Schema contains descriptions and detailed information about each product sold by the company.

IX
Manages the Information Exchange schema. Schema manages shipping through business-to-business (B2B) applications database.

SH
Manages the Sales schema. Schema stores statistics to facilitate business decisions.

SCOTT
A demonstration account with a simple schema.

Vulnerability Number

V-219768

Documentable

False

Rule Version

O112-C2-011500

Severity Override Guidance

If Oracle is hosted on a server that does not support production systems, and is designated for the deployment of samples and demonstrations, this is not applicable (NA).

Review documentation and websites from Oracle and any other relevant vendors for vendor-provided demonstration or sample databases, database applications, schemas, objects, and files.

Review the Oracle DBMS to determine if any of the demonstration and sample databases, schemas, database applications, or files are installed in the database or are included with the DBMS application. If any are present in the database or are included with the DBMS application, this is a finding.

The Oracle Default Sample Schema User Accounts are:

BI
Owns the Business Intelligence schema included in the Oracle Sample Schemas.

HR
Manages the Human Resources schema. Schema stores information about the employees and the facilities of the company.

OE
Manages the Order Entry schema. Schema stores product inventories and sales of the company's products through various channels.

PM
Manages the Product Media schema. Schema contains descriptions and detailed information about each product sold by the company.

IX
Manages the Information Exchange schema. Schema manages shipping through business-to-business (B2B) applications database.

SH
Manages the Sales schema. Schema stores statistics to facilitate business decisions.

SCOTT
A demonstration account with a simple schema.

Check Content Reference

M

Target Key

4057

Comments