STIGQter STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Network access to Oracle Database must be restricted to authorized personnel.

DISA Rule

SV-270539r1064895_rule

Vulnerability Number

V-270539

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-011200

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the database listener to restrict access by IP address or set up an external device to restrict network access to the DBMS.

More information can be found at https://docs.oracle.com/en/database/oracle/oracle-database/19/netrf/parameters-for-the-sqlnet.ora.html#GUID-5C3AB641-7541-4CE9-BC9E-BA5DD30616A8.

Check Contents

IP address restriction may be defined for the database listener, by use of the Oracle Connection Manager or by an external network device.

Identify the method used to enforce address restriction (interview database administrator [DBA]) or review system documentation).

If enforced by the database listener, then review the SQLNET.ORA file located in the ORACLE_HOME/network/admin directory (this assumes that a single sqlnet.ora file, in the default location, is in use; SQLNET.ORA could also be the directory indicated by the TNS_ADMIN environment variable or registry setting).

If the following entries do not exist, then restriction by IP address is not configured and is a finding.

tcp.validnode_checking=YES
tcp.invited_nodes=(IP1, IP2, IP3)

If enforced by an Oracle Connection Manager, then review the CMAN.ORA file for the Connection Manager (located in the TNS_ADMIN or ORACLE_HOME/network/admin directory for the connection manager).

If a RULE entry allows all addresses ("/32") or does not match the address range specified in the system documentation, this is a finding.

(rule=(src=[IP]/27)(dst=[IP])(srv=*)(act=accept))

Note: An IP address with a "/" indicates acceptance by subnet mask where the number after the "/" is the left most number of bits in the address that must match for the rule to apply.

Vulnerability Number

V-270539

Documentable

False

Rule Version

O19C-00-011200

Severity Override Guidance

IP address restriction may be defined for the database listener, by use of the Oracle Connection Manager or by an external network device.

Identify the method used to enforce address restriction (interview database administrator [DBA]) or review system documentation).

If enforced by the database listener, then review the SQLNET.ORA file located in the ORACLE_HOME/network/admin directory (this assumes that a single sqlnet.ora file, in the default location, is in use; SQLNET.ORA could also be the directory indicated by the TNS_ADMIN environment variable or registry setting).

If the following entries do not exist, then restriction by IP address is not configured and is a finding.

tcp.validnode_checking=YES
tcp.invited_nodes=(IP1, IP2, IP3)

If enforced by an Oracle Connection Manager, then review the CMAN.ORA file for the Connection Manager (located in the TNS_ADMIN or ORACLE_HOME/network/admin directory for the connection manager).

If a RULE entry allows all addresses ("/32") or does not match the address range specified in the system documentation, this is a finding.

(rule=(src=[IP]/27)(dst=[IP])(srv=*)(act=accept))

Note: An IP address with a "/" indicates acceptance by subnet mask where the number after the "/" is the left most number of bits in the address that must match for the rule to apply.

Check Content Reference

M

Target Key

5672