STIGQter: STIG Summary: IBM DB2 V10.5 LUW Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 25 Oct 2019:

DB2 must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

DISA Rule

SV-89239r1_rule

Vulnerability Number

V-74565

Group Title

SRG-APP-000340-DB-000304

Rule Version

DB2X-00-007000

Severity

CAT I

CCI(s)

• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Use appropriate OS utility to remove the non-authorized users form privileged groups.

Use REVOKE command to revoke database level or object privileges from non-authorized users.

Note: The following views and table functions list information about privileges held by users, identities of users granting privileges, and object ownership:
SYSCAT.COLAUTH: Lists the column privileges
SYSCAT.DBAUTH: Lists the database privileges
SYSCAT.INDEXAUTH: Lists the index privileges
SYSCAT.MODULEAUTH: Lists the module privileges
SYSCAT.PACKAGEAUTH: Lists the package privileges
SYSCAT.PASSTHRUAUTH: Lists the server privilege
SYSCAT.ROLEAUTH: Lists the role privileges
SYSCAT.ROUTINEAUTH: Lists the routine (functions, methods, and stored procedures) privileges
SYSCAT.SCHEMAAUTH: Lists the schema privileges
SYSCAT.SEQUENCEAUTH: Lists the sequence privileges
SYSCAT.SURROGATEAUTHIDS: Lists the authorization IDs for which another authorization ID can act as a surrogate.
SYSCAT.TABAUTH: Lists the table and view privileges
SYSCAT.TBSPACEAUTH: Lists the table space privileges
SYSCAT.VARIABLEAUTH: Lists the variable privileges
SYSCAT.WORKLOADAUTH: Lists the workload privileges
SYSCAT.XSROBJECTAUTH: Lists the XSR object privileges

Check Contents

Review the system documentation to obtain the definition of the DB2 functionality considered privileged in the context of the system in question.

Run the following command to find the privileged groups to get the value of SYSADM_GROUP, SYSCTRL_GROUP, SYSMAINT_GROUP, SYSMON_GROUP:

$db2 get dbm cfg

If non-privileged users are members of any of these groups, this is a finding.

Run the following SQL command to find the database authorities:
DB2> SELECT * FROM SYSCAT.DBAUTH

If non-privileged users have any database authority, this is a finding.

Query the following system catalog views to find out the authorities on all database objects:

SYSCAT.COLAUTH: Lists the column privileges
SYSCAT.DBAUTH: Lists the database privileges
SYSCAT.INDEXAUTH: Lists the index privileges
SYSCAT.MODULEAUTH: Lists the module privileges
SYSCAT.PACKAGEAUTH: Lists the package privileges
SYSCAT.PASSTHRUAUTH: Lists the server privilege
SYSCAT.ROLEAUTH: Lists the role privileges
SYSCAT.ROUTINEAUTH: Lists the routine (functions, methods, and stored procedures) privileges
SYSCAT.SCHEMAAUTH: Lists the schema privileges
SYSCAT.SEQUENCEAUTH: Lists the sequence privileges
SYSCAT.SURROGATEAUTHIDS: Lists the authorization IDs for which another authorization ID can act as a surrogate.
SYSCAT.TABAUTH: Lists the table and view privileges
SYSCAT.TBSPACEAUTH: Lists the table space privileges
SYSCAT.VARIABLEAUTH: Lists the variable privileges
SYSCAT.WORKLOADAUTH: Lists the workload privileges
SYSCAT.XSROBJECTAUTH: Lists the XSR object privileges

If non-privileged users have any authority, this is a finding.

Vulnerability Number

V-74565

Documentable

False

Rule Version

DB2X-00-007000

Severity Override Guidance

Review the system documentation to obtain the definition of the DB2 functionality considered privileged in the context of the system in question.

Run the following command to find the privileged groups to get the value of SYSADM_GROUP, SYSCTRL_GROUP, SYSMAINT_GROUP, SYSMON_GROUP:

$db2 get dbm cfg

If non-privileged users are members of any of these groups, this is a finding.

Run the following SQL command to find the database authorities:
DB2> SELECT * FROM SYSCAT.DBAUTH

If non-privileged users have any database authority, this is a finding.

Query the following system catalog views to find out the authorities on all database objects:

SYSCAT.COLAUTH: Lists the column privileges
SYSCAT.DBAUTH: Lists the database privileges
SYSCAT.INDEXAUTH: Lists the index privileges
SYSCAT.MODULEAUTH: Lists the module privileges
SYSCAT.PACKAGEAUTH: Lists the package privileges
SYSCAT.PASSTHRUAUTH: Lists the server privilege
SYSCAT.ROLEAUTH: Lists the role privileges
SYSCAT.ROUTINEAUTH: Lists the routine (functions, methods, and stored procedures) privileges
SYSCAT.SCHEMAAUTH: Lists the schema privileges
SYSCAT.SEQUENCEAUTH: Lists the sequence privileges
SYSCAT.SURROGATEAUTHIDS: Lists the authorization IDs for which another authorization ID can act as a surrogate.
SYSCAT.TABAUTH: Lists the table and view privileges
SYSCAT.TBSPACEAUTH: Lists the table space privileges
SYSCAT.VARIABLEAUTH: Lists the variable privileges
SYSCAT.WORKLOADAUTH: Lists the workload privileges
SYSCAT.XSROBJECTAUTH: Lists the XSR object privileges

If non-privileged users have any authority, this is a finding.

Check Content Reference

M

Target Key

3161

Comments