STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

DISA Rule

SV-270497r1167730_rule

Vulnerability Number

V-270497

Group Title

SRG-APP-000295-DB-000305

Rule Version

O19C-00-000300

Severity

CAT II

CCI(s)

• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
• CCI-002363 - Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.

Weight

10

Fix Recommendation

Configure the database management system (DBMS) to automatically terminate a user session after organization-defined conditions, 15 minutes, or a trigger event requiring session termination.

To terminate a session after a certain amount of time independent of the consumed resources needed by other users, then set the MAX_IDLE_TIME initialization parameter. The MAX_IDLE_TIME parameter specifies the maximum number of minutes a session can be idle. After the specified amount of time, MAX_IDLE_TIME kills sessions.

ALTER SYSTEM SET max_idle_time = 15
COMMENT = 'Altered <date> for STIG compliance' -- self documenting
SID = '*' -- required for RAC
SCOPE = BOTH;

Check Contents

Review system documentation to obtain the organization's definition of circumstances requiring automatic session termination. If the documentation explicitly states that such termination is not required or is prohibited, this is not a finding.

If no documentation exists or an automatic session termination time is not explicitly defined, assume a time of 15 minutes.

To check the max_idle_time set, run the following query:

SELECT gp.inst_id, gp.con_id, gp.value
FROM sys.gv_$parameter gp
WHERE gp.name = 'max_idle_time';

If the value returned is "0" or does not match the documented requirement (or 15 when none is specified), this is a finding.

Vulnerability Number

V-270497

Documentable

False

Rule Version

O19C-00-000300

Severity Override Guidance

Review system documentation to obtain the organization's definition of circumstances requiring automatic session termination. If the documentation explicitly states that such termination is not required or is prohibited, this is not a finding.

If no documentation exists or an automatic session termination time is not explicitly defined, assume a time of 15 minutes.

To check the max_idle_time set, run the following query:

SELECT gp.inst_id, gp.con_id, gp.value
FROM sys.gv_$parameter gp
WHERE gp.name = 'max_idle_time';

If the value returned is "0" or does not match the documented requirement (or 15 when none is specified), this is a finding.

Check Content Reference

M

Target Key

5672