STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

OS accounts used to run external procedures called by Oracle Database must have limited privileges.

DISA Rule

SV-270555r1115550_rule

Vulnerability Number

V-270555

Group Title

SRG-APP-000141-DB-000093

Rule Version

O19C-00-013200

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Limit privileges to DBMS-related OS accounts to those required to perform their DBMS specific functionality.

Check Contents

Determine which OS accounts are used by Oracle to run external procedures.

Validate that these OS accounts have only the privileges necessary to perform the required functionality.

If any OS accounts used by the database for running external procedures have privileges beyond those required for running the external procedures, this is a finding.

If use of the external procedure agent is authorized, ensure extproc is restricted to execution of authorized applications.

External jobs are run using the account "nobody" by default.

Review the contents of the file ORACLE_HOME/rdbms/admin/externaljob.ora for the lines run_user= and run_group=.

If the user assigned to these parameters is not "nobody", this is a finding.

System views providing privilege information are:
DBA_SYS_PRIVS
DBA_TAB_PRIVS
DBA_ROLE_PRIVS

Vulnerability Number

V-270555

Documentable

False

Rule Version

O19C-00-013200

Severity Override Guidance

Determine which OS accounts are used by Oracle to run external procedures.

Validate that these OS accounts have only the privileges necessary to perform the required functionality.

If any OS accounts used by the database for running external procedures have privileges beyond those required for running the external procedures, this is a finding.

If use of the external procedure agent is authorized, ensure extproc is restricted to execution of authorized applications.

External jobs are run using the account "nobody" by default.

Review the contents of the file ORACLE_HOME/rdbms/admin/externaljob.ora for the lines run_user= and run_group=.

If the user assigned to these parameters is not "nobody", this is a finding.

System views providing privilege information are:
DBA_SYS_PRIVS
DBA_TAB_PRIVS
DBA_ROLE_PRIVS

Check Content Reference

M

Target Key

5672