STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

The Oracle SQL92_SECURITY parameter must be set to TRUE.

DISA Rule

SV-270525r1112473_rule

Vulnerability Number

V-270525

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-009300

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Enable SQL92 security.

From SQL*Plus:

alter system set sql92_security = TRUE scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.

Check Contents

To verify the current status of the SQL92_SECURITY parameter use the SQL statement:

If using a non-CDB database:
From SQL*Plus:

select value from v$parameter where name = 'sql92_security';

If using a CDB database:
From SQL*Plus:

column name format a20
column parameter_value format a20

SELECT name, inst_id, con_id, value AS PARAMETER_VALUE
FROM sys.gv_$parameter
WHERE name = 'sql92_security'
ORDER BY 1;

Check Result:

The CDB database and all PDBs must be checked.

If the value returned is set to FALSE, this is a finding.

If the parameter is set to TRUE or does not exist, this is not a finding.

In any instance or container, if the PARAMETER_VALUE is not TRUE, that is a finding.

Vulnerability Number

V-270525

Documentable

False

Rule Version

O19C-00-009300

Severity Override Guidance

To verify the current status of the SQL92_SECURITY parameter use the SQL statement:

If using a non-CDB database:
From SQL*Plus:

select value from v$parameter where name = 'sql92_security';

If using a CDB database:
From SQL*Plus:

column name format a20
column parameter_value format a20

SELECT name, inst_id, con_id, value AS PARAMETER_VALUE
FROM sys.gv_$parameter
WHERE name = 'sql92_security'
ORDER BY 1;

Check Result:

The CDB database and all PDBs must be checked.

If the value returned is set to FALSE, this is a finding.

If the parameter is set to TRUE or does not exist, this is not a finding.

In any instance or container, if the PARAMETER_VALUE is not TRUE, that is a finding.

Check Content Reference

M

Target Key

5672