STIGQter: STIG Summary: Oracle Database 11g Installation STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

The Oracle SEC_PROTOCOL_ERROR_TRACE_ACTION parameter should not be set to NONE.

DISA Rule

SV-24959r2_rule

Vulnerability Number

V-16054

Group Title

Oracle SEC_PROTOCOL_ERROR_TRACE_ACTION parameter

Rule Version

DO6752-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Set the value for the sec_protocol_error_trace_action initialization parameter to ALERT or LOG.

TRACE may be appropriate for testing or development, but provides more detail than may be useful.

Consider using ALERT for MAC 1 systems.

From SQL*Plus:

alter system set sec_protocol_error_trace_action = 'ALERT' scope = spfile;
OR
alter system set sec_protocol_error_trace_action = 'LOG' scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.

Check Contents

From SQL*Plus:

select value from v$parameter where name = 'sec_protocol_error_trace_action';

If the value returned is NONE, this is a Finding.

If the value returned is TRACE, LOG or ALERT, this is Not a Finding.

Vulnerability Number

V-16054

Documentable

False

Rule Version

DO6752-ORACLE11

Severity Override Guidance

From SQL*Plus:

select value from v$parameter where name = 'sec_protocol_error_trace_action';

If the value returned is NONE, this is a Finding.

If the value returned is TRACE, LOG or ALERT, this is Not a Finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1368

Comments