STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.

DISA Rule

SV-270524r1112471_rule

Vulnerability Number

V-270524

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-009200

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Set the parameter to FALSE for all instances. If using Oracle Multitenant, set the value to FALSE for the container database and all pluggable databases will be set to FALSE as well.

ALTER SYSTEM SET remote_os_roles = FALSE scope=spfile;

sid='container_name' is optional

Restart the database for the change to take effect.

Check Contents

To verify the current status of the remote_os_roles parameter use the SQL statement:

If using a non-CDB database:

From SQL*Plus:

COLUMN name format a20
COLUMN parameter_value format a20

SELECT name, con_id, value AS PARAMETER_VALUE
FROM sys.v_$parameter
WHERE vp.name = 'remote_os_roles'
ORDER BY 1;

If the PARAMETER_VALUE is not FALSE, that is a finding.

If using a CDB database:

From SQL*Plus (in the CDB database):

COLUMN name format a20
COLUMN parameter_value format a20

SELECT name, inst_id, con_id, value AS PARAMETER_VALUE
FROM sys.gv_$parameter
WHERE vp.name = 'remote_os_roles'
ORDER BY 1;

In the CDB database, if the PARAMETER_VALUE is not FALSE, that is a finding.

Vulnerability Number

V-270524

Documentable

False

Rule Version

O19C-00-009200

Severity Override Guidance

To verify the current status of the remote_os_roles parameter use the SQL statement:

If using a non-CDB database:

From SQL*Plus:

COLUMN name format a20
COLUMN parameter_value format a20

SELECT name, con_id, value AS PARAMETER_VALUE
FROM sys.v_$parameter
WHERE vp.name = 'remote_os_roles'
ORDER BY 1;

If the PARAMETER_VALUE is not FALSE, that is a finding.

If using a CDB database:

From SQL*Plus (in the CDB database):

COLUMN name format a20
COLUMN parameter_value format a20

SELECT name, inst_id, con_id, value AS PARAMETER_VALUE
FROM sys.gv_$parameter
WHERE vp.name = 'remote_os_roles'
ORDER BY 1;

In the CDB database, if the PARAMETER_VALUE is not FALSE, that is a finding.

Check Content Reference

M

Target Key

5672