Rule ID
SV-270529r1263642_rule
Version
V1R6
CCIs
The WITH ADMIN OPTION allows the grantee to grant a role to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized personnel include database administrators (DBAs), object owners, and application administrators (where designed and included in the application's functions). Restricting privilege-granting functions to authorized accounts can help decrease mismanagement of privileges and wrongful assignments to unauthorized accounts.
Use the following query to identify users with the ADMIN option.
sqlplus connect as sysdba
SELECT con_id, grantee, granted_role
FROM sys.cdb_role_privs
WHERE admin_option = 'YES'
AND (con_id, grantee) NOT IN (
SELECT con_id, username
FROM sys.cdb_users WHERE oracle_maintained = 'Y')
AND (con_id, grantee) NOT IN (
SELECT con_id, role
FROM sys.cdb_roles WHERE oracle_maintained = 'Y')
AND (grantee) not in ('PDBUSER')
ORDER BY 1,2,3;
Review the system documentation to confirm any grantees listed are information system security officer (ISSO)-authorized DBA accounts or application administration roles.
If any grantees listed are not authorized and documented, this is a finding.Revoke assignment of roles with the WITH ADMIN OPTION from unauthorized grantees and regrant them without the option if required. SQL statements to remove the admin option from an unauthorized grantee: REVOKE [privilege name] FROM [grantee]; Re-grant the revoked privileges without specifying WITH ADMIN OPTION if they are otherwise authorized to have the privilege but are not authorized as administrators to administer the privilege. Restrict use of the WITH ADMIN OPTION to authorized administrators. Document authorized role assignments with the WITH ADMIN OPTION in the system documentation.