STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must protect against or limit the effects of organization-defined types of denial-of-service (DoS) attacks.

DISA Rule

SV-270496r1167727_rule

Vulnerability Number

V-270496

Group Title

SRG-APP-000001-DB-000031

Rule Version

O19C-00-000200

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

Implement measures to limit the effects of organization-defined types of DoS attacks.

For each of the three queries in the Check, if there are findings, make the changes required to bring the environment into compliance.

For Listing 1:
Modify the $ORACLE_HOME/network/admin/listener.ora to establish a Rate Limit.
Restart the listener for changes to take effect.

For Listing 2:
Set limits on all profiles for CPU_PER_CALL, IDLE_TIME, and LOGICAL_READS_PER_CALL.

For Listing 3:
Enforce reasonable limits for tablespace consumption sufficient to prevent a DOS attack from impacting multiple applications or multiple services.

Check Contents

Review database management system (DBMS) settings to verify the DBMS implements measures to limit the effects of a DoS event.

Rate Limit:

Check the $ORACLE_HOME/network/admin/listener.ora to verify a Rate Limit has been established. A rate limit is used to prevent DoS attacks on a database or to control a logon storm such as may be caused by an application server or pool restart.

If a rate limit has not been set similar to one of the two examples in Listing 1, this is a finding.

Listing 1
CONNECTION_RATE_LISTENER=10
LISTENER= (
ADDRESS_LIST=
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521)(RATE_LIMIT=yes))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1522)(RATE_LIMIT=yes))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1526))
)
LISTENER=
(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521)(RATE_LIMIT=8))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1522)(RATE_LIMIT=12))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1526))
)

Database Profiles:
If the database profiles, as shown in Listing 2 do not contain resource controls similar to those shown, but appropriate to the target database's infrastructure and utilization, that is a finding.

Listing 2
SELECT cp.con_id, cp.profile, cp.resource_name, cp.limit
FROM sys.cdb_profiles cp
WHERE resource_name IN ('CPU_PER_CALL', 'IDLE_TIME', 'LOGICAL_READS_PER_CALL');
ORDER BY 1,2,3;


Tablespace Quota:

Listing 3
SELECT ctq.con_id, ctq.tablespace_name, ctq.username, ctq.max_bytes, ctq.max_blocks
FROM sys.cdb_ts_quotas ctq
WHERE ((max_bytes = -1) OR (max_blocks = -1))
AND (ctq.con_id, ctq.tablespace_name) IN (SELECT ct.con_id, ct.tablespace_name FROM sys.cdb_tablespaces ct)
ORDER BY 1;

If any rows returned have a MAX_BYTES or MAX_BLOCKS equal to minus one (-1) that is a finding.

Vulnerability Number

V-270496

Documentable

False

Rule Version

O19C-00-000200

Severity Override Guidance

Review database management system (DBMS) settings to verify the DBMS implements measures to limit the effects of a DoS event.

Rate Limit:

Check the $ORACLE_HOME/network/admin/listener.ora to verify a Rate Limit has been established. A rate limit is used to prevent DoS attacks on a database or to control a logon storm such as may be caused by an application server or pool restart.

If a rate limit has not been set similar to one of the two examples in Listing 1, this is a finding.

Listing 1
CONNECTION_RATE_LISTENER=10
LISTENER= (
ADDRESS_LIST=
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521)(RATE_LIMIT=yes))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1522)(RATE_LIMIT=yes))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1526))
)
LISTENER=
(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521)(RATE_LIMIT=8))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1522)(RATE_LIMIT=12))
(ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1526))
)

Database Profiles:
If the database profiles, as shown in Listing 2 do not contain resource controls similar to those shown, but appropriate to the target database's infrastructure and utilization, that is a finding.

Listing 2
SELECT cp.con_id, cp.profile, cp.resource_name, cp.limit
FROM sys.cdb_profiles cp
WHERE resource_name IN ('CPU_PER_CALL', 'IDLE_TIME', 'LOGICAL_READS_PER_CALL');
ORDER BY 1,2,3;


Tablespace Quota:

Listing 3
SELECT ctq.con_id, ctq.tablespace_name, ctq.username, ctq.max_bytes, ctq.max_blocks
FROM sys.cdb_ts_quotas ctq
WHERE ((max_bytes = -1) OR (max_blocks = -1))
AND (ctq.con_id, ctq.tablespace_name) IN (SELECT ct.con_id, ct.tablespace_name FROM sys.cdb_tablespaces ct)
ORDER BY 1;

If any rows returned have a MAX_BYTES or MAX_BLOCKS equal to minus one (-1) that is a finding.

Check Content Reference

M

Target Key

5672