← Back to Oracle Database 12c Security Technical Implementation Guide

V-219829

CAT II (Medium)

The Oracle WITH GRANT OPTION privilege must not be granted to non-DBA or non-Application administrator user accounts.

Rule ID

SV-219829r879887_rule

STIG

Oracle Database 12c Security Technical Implementation Guide

Version

V2R9

CCIs

CCI-000366

Discussion

An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged account exploitation. Application user accounts must never require WITH GRANT OPTION privileges since, by definition, they require only privileges to execute procedures or view / edit data.

Check Content

Execute the query:

select grantee||': '||owner||'.'||table_name
from dba_tab_privs 
where grantable = 'YES' 
and grantee not in (select distinct owner from dba_objects)
and grantee not in (select grantee from dba_role_privs where granted_role = 'DBA')
and table_name not like 'SYS_PLSQL_%'
order by grantee;

If any accounts are listed, this is a finding.

Fix Text

Revoke privileges granted the WITH GRANT OPTION from non-DBA and accounts that do not own application objects.

Re-grant privileges without specifying WITH GRANT OPTION.

Note: Do not revoke the system-generated grants such as those found on The SYS_PLSQL_% objects. They are system generated object types (a.k.a ShadowTypes) which are created internally by Oracle when you use the Pipelined Table Functions. This can result in (incorrect) compilation failures and/or invalidations when the users who are supposed to have access to the shadow types find themselves without access.