Ensure that access to dynamic query-related tables is restricted

OrtaDüzey 1Manuel incelemedb2-zos

Açıklama

The following tables contain information related to the stabilization of access paths for dynamic SQL statements and dependencies for dynamic query packages: SYSIBM.SYSDYNQRY SYSIBM.SYSDYNQRYDEP SYSIBM.SYSDYNQRY_TXTL PUBLIC should be restricted from accessing these tables. Exposing dynamic SQL statements and dynamic queries can enable attackers to gain access to your organization's data.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

For Db2 internal security users: Issue the following SQL statement to check if PUBLIC has access: SELECT GRANTEE, TCREATOR, TTNAME FROM SYSIBM.SYSTABAUTH WHERE TCREATOR = 'SYSIBM' AND TTNAME IN ('SYSDYNQRY', 'SYSDYNQRYDEP', 'SYSDYNQRY_TXTL') AND GRANTEE = 'PUBLIC'; Output that contains zero rows is considered a successful finding. Otherwise, PUBLIC has SELECT privilege and the remediation steps should be followed. For external security users: Issue the RACF RLIST command to list the profiles that control access to the dynamic query-related tables in the ... (full steps: CIS section 2.2.9)

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For Db2 internal security users: Issue the SQL REVOKE statement to revoke access from PUBLIC. For external security users: Issue the RACF RALTER command to update the profiles and change the UACC setting to NONE. Issue the RACF PERMIT command to remove the ID(*) and specify users or groups.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: db2-zospermissions
Referans: CIS IBM Db2 13 for z/OS Benchmark v1.0.0 - 2.2.9 Ensure that access to dynamic query-related tables is restricted