← Back to Oracle Database 19c Security Technical Implementation Guide

V-270527

CAT II (Medium)

System privileges granted using the WITH ADMIN OPTION must not be granted to unauthorized user accounts.

Rule ID

SV-270527r1263636_rule

STIG

Oracle Database 19c Security Technical Implementation Guide

Version

V1R6

CCIs

CCI-000366

Discussion

The WITH ADMIN OPTION allows the grantee to grant a privilege to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized personnel include database administrators (DBAs), object owners, and, where designed and included in the application's functions, application administrators. Restricting privilege-granting functions to authorized accounts can help decrease mismanagement of privileges and wrongful assignments to unauthorized accounts.

Check Content

Use the following query to identify users with the ADMIN option.

sqlplus connect as sysdba

SELECT con_id, grantee, privilege
FROM sys.cdb_sys_privs 
WHERE admin_option = 'YES'
AND (con_id, grantee) NOT IN (
  SELECT con_id, username 
  FROM sys.cdb_users WHERE oracle_maintained = 'Y')
AND grantee not in ('DV_ACCTMGR', 'SCHEDULER_ADMIN', 'AQ_ADMINISTRATOR_ROLE')
ORDER BY 1,2,3;

If any accounts that are not authorized to have the ADMIN OPTION are listed, this is a finding.

Fix Text

Revoke assignment of privileges with the WITH ADMIN OPTION from unauthorized users and regrant them without the option.

From SQL*Plus:

revoke [privilege name] from user [username];

Replace [privilege name] with the named privilege and [username] with the named user.

Re-grant the revoked privileges without specifying WITH ADMIN OPTION if they are otherwise authorized to have the privilege but are not authorized as administrators to administer the privilege.

Restrict use of the WITH ADMIN OPTION to authorized administrators.

Document authorized privilege assignments with the WITH ADMIN OPTION in the system documentation.