V-219771

Discussion

Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plugins not related to requirements or providing a wide array of functionality not required for the mission. Applications must adhere to the principles of least functionality by providing only essential capabilities. DBMS's may spawn additional external processes to execute procedures that are defined in the DBMS, but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than the DBMS and provide unauthorized access to the host system.

Check Content

Review the database for definitions of application executable objects stored external to the database.

Determine if there are methods to disable use or access, or to remove definitions for external executable objects.

Verify any application executable objects listed are authorized by the ISSO.

If any are not, this is a finding.
If the external executables or libraries are owned by ''SYS'' this is not a finding.


To check for external procedures, execute the following query, which will provide the libraries containing external procedures, the owners of those libraries, users that have been granted access to those libraries, and the privileges they have been granted. If there are owners other than the owners that Oracle provides, there may be executable objects stored either in the database or external to the database that are called by objects in the database. Check to see that those owners are authorized to access those libraries. If there are users that have been granted access to libraries provided by Oracle, check to see that they are authorized to access those libraries.

(connect as sysdba)
set linesize 130
column library_name format a25
column name format a15
column owner format a15
column grantee format a15
column privilege format a15
select library_name,owner, '' grantee, '' privilege
from dba_libraries where file_spec is not null
minus
(
select library_name,o.name owner, '' grantee, '' privilege
from dba_libraries l,
sys.user$ o,
sys.user$ ge,
sys.obj$ obj,
sys.objauth$ oa
where l.owner=o.name
and obj.owner#=o.user#
and obj.name=l.library_name
and oa.obj#=obj.obj#
and ge.user#=oa.grantee#
and l.file_spec is not null
)
union all
select library_name,o.name owner, --obj.obj#,oa.privilege#,
ge.name grantee,
tpm.name privilege
from dba_libraries l,
sys.user$ o,
sys.user$ ge,
sys.obj$ obj,
sys.objauth$ oa,
sys.table_privilege_map tpm
where l.owner=o.name
and obj.owner#=o.user#
and obj.name=l.library_name
and oa.obj#=obj.obj#
and ge.user#=oa.grantee#
and tpm.privilege=oa.privilege#
and l.file_spec is not null
/