Remote administration must be disabled for the Oracle connection manager.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-61533 | O121-BP-026500 | SV-76023r1_rule | Medium |
| Description |
|---|
| Remote administration provides a potential opportunity for malicious users to make unauthorized changes to the Connection Manager configuration or interrupt its service. |
| STIG | Date |
|---|---|
| Oracle Database 12c Security Technical Implementation Guide | 2018-09-18 |
Details
| Check Text ( C-62405r1_chk ) |
|---|
| View the cman.ora file in the ORACLE_HOME/network/admin directory. If the file does not exist, the database is not accessed via Oracle Connection Manager and this check is not a finding. If the entry and value for REMOTE_ADMIN is not listed or is not set to a value of NO (REMOTE_ADMIN = NO), this is a finding. |
| Fix Text (F-67449r1_fix) |
|---|
| View the cman.ora file in the ORACLE_HOME/network/admin directory of the Connection Manager. Include the following line in the file: REMOTE_ADMIN = NO |