TMA-ORACLE-DB-6.1.3

Ensure 'IMPORT' And 'EXPORT' 'FULL DATABASE' Is Revoked From Unauthorized 'GRANTEE'

높음레벨 1자동oracle-db

설명

The EXPORT FULL DATABASE and IMPORT FULL DATABASE privileges in Oracle Database allow users to perform full database exports and imports, which can lead to data exfiltration, unauthorized modifications, and compliance violations if granted to unauthorized users. Counts non-Oracle-maintained users and roles holding the privilege directly or through a role chain (CDB_SYS_PRIVS / CDB_ROLE_PRIVS); 0 is required, so every approved grantee must be reviewed and documented as an exception. Run on the database host as the Oracle software owner with ORACLE_HOME, ORACLE_SID and PATH set; connects to the CDB root with 'sqlplus -S / as sysdba' (OS authentication) so CDB_/GV$ views cover all open PDBs.

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(sqlplus -S -L / as sysdba 2>/dev/null <<'EOF'
whenever sqlerror exit failure
set heading off feedback off pagesize 0 verify off echo off trimspool on define off
with nm as (
  select role as grantee from cdb_roles where oracle_maintained = 'N'
  union select username from cdb_users where oracle_maintained = 'N'
),
direct_privs as (select grantee from cdb_sys_privs where privilege in ('IMPORT FULL DATABASE','EXPORT FULL DATABASE')),
indirect_privs as (
  select grantee from cdb_role_privs
  start with granted_role in (select p.grantee from cdb_sys_privs p, cdb_roles r where p.privilege in ('IMPORT FULL DATABASE','EXPORT FULL DATABASE') and p.grantee = r.role)
  connect by nocycle prior grantee = granted_role
)
select count(*) from (select grantee from direct_privs union select grantee from indirect_privs) c
where c.grantee in (select grantee from nm);
exit
EOF
) || exit 1
printf '%s\n' "$out"

예상 출력: 0

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remediate this setting, execute the following SQL statement, keeping in mind if this is granted in both container and pluggable database, you must connect to both places to revoke. Please ensure proper impact analysis is done before revoking the privilege from a role. REVOKE IMPORT FULL DATABASE FROM <grantee>; REVOKE EXPORT FULL DATABASE FROM <grantee>; In the case of a grant via a role: REVOKE <rolename> FROM <grantee>;

속성

운영 체제: 모두
태그: oracle-dbdatabaseoracleprivileges
참고 자료: CIS Oracle Database 23ai Benchmark v1.1.0 - 6.1.3 Ensure 'IMPORT' And 'EXPORT' 'FULL DATABASE' Is Revoked From Unauthorized 'GRANTEE'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oracle-db