Oracle Database 12c Security Technical Implementation Guide

The Oracle Database 12c Security Technical Implementation Guide (V3 R5) has 136 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

136STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Wed Jul 02 2025

Oracle instance names must not contain Oracle version numbers.

Oracle Database 12c Security Technical Implementation Guide

Assessment Title

Rule Text

Oracle instance names must not contain Oracle version numbers.

Description

Discussion Text

Service names may be discovered by unauthenticated users. If the service name includes version numbers or other database product information, a malicious user may use that information to develop a targeted attack.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-219825

Rule

SV-219825r961863_rule

Severity

medium

Rule Version

O121-BP-021300

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From SQL*Plus:

  select instance_name from v$instance;
  select version from v$instance;

If the instance name returned references the Oracle release number, this is a finding.

Numbers used that include version numbers by coincidence are not a finding.

The DBA should be able to relate the significance of the presence of a digit in the SID.

Implementation Procedure

Fix Text

Follow the instructions in Oracle MetaLink Note 15390.1 (and related documents) to change the SID for the database without re-creating the database to a value that does not identify the Oracle version.

STIG check 2 of 136 in the Oracle Database 12c STIG checklist

← Previous · V-219824Access to default accounts used to support replication must be restricted to authorized DBAs.Next · V-219826 →Fixed user and public database links must be authorized for use.