STIGQter: STIG Summary: IBM DB2 V10.5 LUW Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 25 Oct 2019:

Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to DB2, etc.) must be owned by database/DBMS principals authorized for ownership.

DISA Rule

SV-89147r1_rule

Vulnerability Number

V-74473

Group Title

SRG-APP-000133-DB-000200

Rule Version

DB2X-00-003200

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Use the list identified in check. Drop and create the objects as necessary with the correct ownership.
DB2> DROP
DB2> CREATE

Note: For additional information regarding the DROP statement, select the following link:
http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.sql.ref.doc/doc/r0000945.html?lang=en

Check Contents

Get the list of authorized owners from ISSO or DBA.

Use the following catalog views/queries to find the ownership of the various database objects:

Select libname,owner from syscat.libraries
Select modulename,owner from syscat.modules
Select tabname,owner from syscat.nicknames
Select pkgname,owner from syscat.packages
Select routinename,owner from syscat.routines
Select seqname,owner from syscat.sequences
Select constname,owner from syscat.tabconst
Select tabname,owner from syscat.tables
Select tbspace,owner from syscat.tablespaces
Select trigname,owner from syscat.triggers

If any owner is not in the ISSO/DBA provided list, this is a finding.

Vulnerability Number

V-74473

Documentable

False

Rule Version

DB2X-00-003200

Severity Override Guidance

Get the list of authorized owners from ISSO or DBA.

Use the following catalog views/queries to find the ownership of the various database objects:

Select libname,owner from syscat.libraries
Select modulename,owner from syscat.modules
Select tabname,owner from syscat.nicknames
Select pkgname,owner from syscat.packages
Select routinename,owner from syscat.routines
Select seqname,owner from syscat.sequences
Select constname,owner from syscat.tabconst
Select tabname,owner from syscat.tables
Select tbspace,owner from syscat.tablespaces
Select trigname,owner from syscat.triggers

If any owner is not in the ISSO/DBA provided list, this is a finding.

Check Content Reference

M

Target Key

3161

Comments