STIGQter STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle instance names must not contain Oracle version numbers.

DISA Rule

SV-270521r1112467_rule

Vulnerability Number

V-270521

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-008600

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Follow the instructions in Oracle MetaLink Note 15390.1 (and related documents) to change the SID for the database without recreating the database to a value that does not identify the Oracle version.

Check Contents

If using a non-CDB database:

From SQL*Plus:

select instance_name, version from v$instance;

If using a CDB database:

To check the container database (CDB):

From SQL*Plus:

select instance_name, version from v$instance;

To check the pluggable databases (PDBs) within the CDB:

select name from v$pdbs;

Check Instance Name:

If the instance name returned references the Oracle release number, this is a finding.

Numbers used that include version numbers by coincidence are not a finding.

The database administrator (DBA) should be able to relate the significance of the presence of a digit in the SID.

Vulnerability Number

V-270521

Documentable

False

Rule Version

O19C-00-008600

Severity Override Guidance

If using a non-CDB database:

From SQL*Plus:

select instance_name, version from v$instance;

If using a CDB database:

To check the container database (CDB):

From SQL*Plus:

select instance_name, version from v$instance;

To check the pluggable databases (PDBs) within the CDB:

select name from v$pdbs;

Check Instance Name:

If the instance name returned references the Oracle release number, this is a finding.

Numbers used that include version numbers by coincidence are not a finding.

The database administrator (DBA) should be able to relate the significance of the presence of a digit in the SID.

Check Content Reference

M

Target Key

5672