STIGQter STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must set the maximum number of consecutive invalid logon attempts to three.

DISA Rule

SV-270550r1112482_rule

Vulnerability Number

V-270550

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-012400

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the database management system (DBMS) setting to specify the maximum number of consecutive failed logon attempts to three (or less):

ALTER PROFILE {PROFILE_NAME} LIMIT FAILED_LOGIN_ATTEMPTS 3;

ORA_STIG_PROFILE is available in DBA_PROFILES.

Note: It is necessary to create a customized replacement for the password validation function, ORA12C_STIG_VERIFY_FUNCTION, if relying on this technique to verify password complexity.

Check Contents

The limit on the number of consecutive failed logon attempts is defined in the profile assigned to a user.

Check the FAILED_LOGIN_ATTEMPTS value assigned to the profiles returned from this query:

SQL>SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES;

Check the setting for FAILED_LOGIN_ATTEMPTS. This is the number of consecutive failed logon attempts before locking the Oracle user account. If the value is greater than three on any of the profiles, this is a finding.

Vulnerability Number

V-270550

Documentable

False

Rule Version

O19C-00-012400

Severity Override Guidance

The limit on the number of consecutive failed logon attempts is defined in the profile assigned to a user.

Check the FAILED_LOGIN_ATTEMPTS value assigned to the profiles returned from this query:

SQL>SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES;

Check the setting for FAILED_LOGIN_ATTEMPTS. This is the number of consecutive failed logon attempts before locking the Oracle user account. If the value is greater than three on any of the profiles, this is a finding.

Check Content Reference

M

Target Key

5672