STIGQter STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must verify account lockouts persist until reset by an administrator.

DISA Rule

SV-270549r1112480_rule

Vulnerability Number

V-270549

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-012300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the database management system (DBMS) settings to specify indefinite lockout duration:

ALTER PROFILE ORA_STIG_PROFILE LIMIT PASSWORD_LOCK_TIME UNLIMITED;

Check Contents

The account lockout duration is defined in the profile assigned to a user.

To verify what profile is assigned to a user, enter the query:

SQL>SELECT profile FROM dba_users WHERE username = '<username>'

This will return the profile name assigned to that user.

The user profile, ORA_STIG_PROFILE, has been provided to satisfy the STIG requirements pertaining to the profile parameters. Oracle recommends that this profile be customized with any site-specific requirements and assigned to all users where applicable. Note: It remains necessary to create a customized replacement for the password validation function, ORA12C_STIG_VERIFY_FUNCTION, if relying on this technique to verify password complexity.

Now check the values assigned to the profile returned from the query above:

column profile format a20
column limit format a20

SQL>SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE PROFILE = 'ORA_STIG_PROFILE';

Check the settings for password_lock_time - this specifies how long to lock the account after the number of consecutive failed logon attempts reaches the limit. If the value is not UNLIMITED, this is a finding.

Vulnerability Number

V-270549

Documentable

False

Rule Version

O19C-00-012300

Severity Override Guidance

The account lockout duration is defined in the profile assigned to a user.

To verify what profile is assigned to a user, enter the query:

SQL>SELECT profile FROM dba_users WHERE username = '<username>'

This will return the profile name assigned to that user.

The user profile, ORA_STIG_PROFILE, has been provided to satisfy the STIG requirements pertaining to the profile parameters. Oracle recommends that this profile be customized with any site-specific requirements and assigned to all users where applicable. Note: It remains necessary to create a customized replacement for the password validation function, ORA12C_STIG_VERIFY_FUNCTION, if relying on this technique to verify password complexity.

Now check the values assigned to the profile returned from the query above:

column profile format a20
column limit format a20

SQL>SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE PROFILE = 'ORA_STIG_PROFILE';

Check the settings for password_lock_time - this specifies how long to lock the account after the number of consecutive failed logon attempts reaches the limit. If the value is not UNLIMITED, this is a finding.

Check Content Reference

M

Target Key

5672