Only authorized system accounts must have the SYSTEM tablespace specified as the default tablespace.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-219847	SRG-APP-000516-DB-000363	O121-BP-023600	SV-219847r1067809_rule	2025-02-12	3

Description
The Oracle SYSTEM tablespace is used by the database to store all DBMS system objects. Other use of the system tablespace may compromise system availability and the effectiveness of host system access controls to the tablespace files.

ℹ️ Check
Run the query: select property_name, property_value from database_properties where property_name in ('DEFAULT_PERMANENT_TABLESPACE','DEFAULT_TEMP_TABLESPACE'); If either value is set to SYSTEM, this is a finding. Run the query: select username from dba_users where (default_tablespace = 'SYSTEM' or temporary_tablespace = 'SYSTEM') and username not in ('LBACSYS','OUTLN','SYS','SYSTEM', 'SYSKM', 'SYSDG', 'SYSBACKUP', 'SYSRAC'); If any nondefault account records are returned, this is a finding.

ℹ️ Check

Run the query: select property_name, property_value from database_properties where property_name in ('DEFAULT_PERMANENT_TABLESPACE','DEFAULT_TEMP_TABLESPACE'); If either value is set to SYSTEM, this is a finding. Run the query: select username from dba_users where (default_tablespace = 'SYSTEM' or temporary_tablespace = 'SYSTEM') and username not in ('LBACSYS','OUTLN','SYS','SYSTEM', 'SYSKM', 'SYSDG', 'SYSBACKUP', 'SYSRAC'); If any nondefault account records are returned, this is a finding.

✔️ Fix
Create and dedicate tablespaces to support only one application. Do not share tablespaces between applications. Do not grant quotas to application object owners on tablespaces not dedicated to their associated application. Run the queries: alter database default tablespace <tablespace_name>; alter database default temporary tablespace <temporary_tablespace_name>; alter user <username> default tablespace <tablespace_name> temporary tablespace <temporary_tablespace_name>; Replace <username> with the named user account. Replace <tablespace_name> with the new default tablespace name. Replace <temporary_tablespace_name> with the new default temporary tablespace name (typically TEMP). Repeat the "alter user" for each affected user account.

✔️ Fix

Create and dedicate tablespaces to support only one application. Do not share tablespaces between applications. Do not grant quotas to application object owners on tablespaces not dedicated to their associated application. Run the queries: alter database default tablespace <tablespace_name>; alter database default temporary tablespace <temporary_tablespace_name>; alter user <username> default tablespace <tablespace_name> temporary tablespace <temporary_tablespace_name>; Replace <username> with the named user account. Replace <tablespace_name> with the new default tablespace name. Replace <temporary_tablespace_name> with the new default temporary tablespace name (typically TEMP). Repeat the "alter user" for each affected user account.