STIGQter: STIG Summary: Oracle Database 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Oracle software must be evaluated and patched against newly found vulnerabilities.

DISA Rule

SV-237697r667123_rule

Vulnerability Number

V-237697

Group Title

SRG-APP-000456-DB-000390

Rule Version

O121-C1-011100

Severity

CAT I

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Follow the process below to apply the security patch.

Log on to My Oracle Support.

Select patches and download the specific patch number and corresponding MD5 checksum. Once the patch is downloaded to the server, check the MD5 checksum to make sure the patch is valid.

To check the MD5 Checksum in Linux/UNIX, the command is:
$md5sum absolute_path_of_file_name - file_name is the complete location of the downloaded file.
$md5sum /home/oracle/test.zip
a34d8cd98f00cf24e9800998ecf823e4 /home/oracle/test.zip

Once the checksum is validated, apply the patch:
$ cd $ORACLE_HOME
$ opatch apply

Check that the patch was applied and the inventory was updated with the following command (UNIX/Linux):
$ opatch lsinventory -detail

Windows:
> opatch lsinventory –detail

Check Contents

When the Quarterly CPU is released, check the CPU Notice and note the specific patch number for the system.

Then, issue the following command:

SELECT patch_id, version, action, status, description from dba_registry_sqlpatch;

This will generate the patch levels for the home and any specific patches that have been applied to it.

If the currently installed patch levels are lower than the latest, this is a finding.

Vulnerability Number

V-237697

Documentable

False

Rule Version

O121-C1-011100

Severity Override Guidance

When the Quarterly CPU is released, check the CPU Notice and note the specific patch number for the system.

Then, issue the following command:

SELECT patch_id, version, action, status, description from dba_registry_sqlpatch;

This will generate the patch levels for the home and any specific patches that have been applied to it.

If the currently installed patch levels are lower than the latest, this is a finding.

Check Content Reference

M

Target Key

4059

Comments