Details

Unsupported Oracle network client installations may introduce vulnerabilities to the database. Restriction to use of supported versions helps to protect the database and helps to enforce newer, more robust security controls.

Solution

: Deploy Oracle 11.2.0.4 with the January 2014 CPU patch.

Edit the SQLNET.ORA file to add or edit the entry:

SQLNET.ALLOWED_LOGON_VERSION = 12

Set the value to 12 or higher.

For more information on sqlnet.ora parameters refer to the following document:
‘Database Net Services Reference’
https://docs.oracle.com/cd/E11882_01/network.112/e10835/sqlnet.htm#NETRF006

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11-2g_V2R2_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-6b.
• CAT|II
• CCI|CCI-000366
• CSCv6|2.2
• Rule-ID|SV-219746r401224_rule
• STIG-ID|O112-BP-026600
• STIG-Legacy|SV-68317
• STIG-Legacy|V-54077
• Vuln-ID|V-219746

Source

• Tenable.com/audits