STIGQter STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Access to Oracle Database files must be limited to relevant processes and to authorized, administrative users.

DISA Rule

SV-270578r1137658_rule

Vulnerability Number

V-270578

Group Title

SRG-APP-000243-DB-000374

Rule Version

O19C-00-017600

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the permissions of the database files, database log files, and database backup files so that only relevant system accounts and authorized system administrators and database administrators with a need to know are permitted to read/view these files.

Check Contents

Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files.

On Unix Systems:

ls -ld [pathname]

Substitute [pathname] with the directory path where the database files, logs, and database backup files are located.
(examples: /*/app/oracle/oradata/db_name, /*/app/oracle/oradata/db_name/audit, and /*/app/oracle/fast_recovery_area/db_name)

If permissions are granted for world access, this is a finding.

If any user/role who is not an authorized system administrator with a need to know or database administrator with a need to know, or a system account for running DBMS processes, is permitted to read/view any of these files, this is a finding.

On Windows Systems (from Windows Explorer):

Browse to the directory specified (example: %ORACLE_BASE%\oradata and %ORACLE_BASE%\fast_recovery_area). Select and right-click on the directory >> Properties >> Security tab. On Windows hosts, records are also written to the Windows application event log. The location of the application event log is listed under Properties for the log under the Windows console. The default location is C:\WINDOWS\system32\config\EventLogs\AppEvent.Evt.

Select and right-click on the directory >> Properties >> Security tab.

If permissions are granted to everyone, this is a finding.

If any user/role who is not an authorized system administrator with a need to know or database administrator with a need to know, or a system account for running DBMS processes permitted to read/view any of these files, this is a finding.

Vulnerability Number

V-270578

Documentable

False

Rule Version

O19C-00-017600

Severity Override Guidance

Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files.

On Unix Systems:

ls -ld [pathname]

Substitute [pathname] with the directory path where the database files, logs, and database backup files are located.
(examples: /*/app/oracle/oradata/db_name, /*/app/oracle/oradata/db_name/audit, and /*/app/oracle/fast_recovery_area/db_name)

If permissions are granted for world access, this is a finding.

If any user/role who is not an authorized system administrator with a need to know or database administrator with a need to know, or a system account for running DBMS processes, is permitted to read/view any of these files, this is a finding.

On Windows Systems (from Windows Explorer):

Browse to the directory specified (example: %ORACLE_BASE%\oradata and %ORACLE_BASE%\fast_recovery_area). Select and right-click on the directory >> Properties >> Security tab. On Windows hosts, records are also written to the Windows application event log. The location of the application event log is listed under Properties for the log under the Windows console. The default location is C:\WINDOWS\system32\config\EventLogs\AppEvent.Evt.

Select and right-click on the directory >> Properties >> Security tab.

If permissions are granted to everyone, this is a finding.

If any user/role who is not an authorized system administrator with a need to know or database administrator with a need to know, or a system account for running DBMS processes permitted to read/view any of these files, this is a finding.

Check Content Reference

M

Target Key

5672