STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Network client connections must be restricted to supported versions.

DISA Rule

SV-270543r1064907_rule

Vulnerability Number

V-270543

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-011700

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Edit the SQLNET.ORA file to add or edit the entries:

SQLNET.ALLOWED_LOGON_VERSION_SERVER = 12
SQLNET.ALLOWED_LOGON_VERSION_CLIENT = 12

Set the value to 12 or higher.
Valid values for SQLNET.ALLOWED_LOGON_VERSION_SERVER are: 12 and 12a

Valid values for SQLNET.ALLOWED_LOGON_VERSION_CLIENT are: 12 and 12a

For more information on sqlnet.ora parameters refer to the following document:
https://docs.oracle.com/en/database/oracle/oracle-database/19/netrf/parameters-for-the-sqlnet.ora.html

Check Contents

Note: The SQLNET.ALLOWED_LOGON_VERSION parameter is deprecated in earlier Oracle Database versions. This parameter has been replaced with two new Oracle Net Services parameters:

SQLNET.ALLOWED_LOGON_VERSION_SERVER
SQLNET.ALLOWED_LOGON_VERSION_CLIENT

View the SQLNET.ORA file in the ORACLE_HOME/network/admin directory or the directory specified in the TNS_ADMIN environment variable.

Locate the following entries:

SQLNET.ALLOWED_LOGON_VERSION_SERVER = 12
SQLNET.ALLOWED_LOGON_VERSION_CLIENT = 12

If the parameters do not exist, this is a finding.

If the parameters are not set to a value of 12 or 12a, this is a finding.

Note: Attempting to connect with a client version lower than specified in these parameters may result in a misleading error:
ORA-01017: invalid username/password: logon denied

Vulnerability Number

V-270543

Documentable

False

Rule Version

O19C-00-011700

Severity Override Guidance

Check Content Reference

Target Key

5672