Release Notes
Abstract
This document is intended for Guardium Vulnerablity Assessment 12.x clients who upgrade to Guardium Data Protection versions 12.2.4 (GPU 12.0p7240). It lists the updates that are available for Guardium Database Protection Service (DPS), a subscription service that provides periodic updates to vulnerability tests as well as other predefined content, including reports, groups, and policies.
Content
Target audience
This document is intended for Guardium Vulnerablity Assessment 12.x clients who upgrade to Guardium Data Protection 12.2.4 (GPU 12.0p7240). The Guardium 12.x Special DPS file described in this document must be applied after you upgrade to 12.2.4 (GPU 12.0p7240) from a previous version.
Customers should also check IBM Support Fix Central for the latest Rapid Response DPS release and apply it after uploading this special DPS file.
DPS file
| Fix ID | Guardium_12.X_DPS-Special-Q3-2026 |
|---|---|
| File name | Guardium_V12_Quarterly_DPS_2026_Q3_20260828.enc |
| MD5SUM | 5393fd7ba7111f1b6de2ba2f760b9c0d |
Prerequisites
Guardium Data Protection patch 12.2.4 (GPU 12.0p7240; see release notes)
Notes
IBM Db2 for z/OS Test ID 360 “AUTHCACH subsystem parameter is set properly” is deprecated for IBM Db2 13 for z/OS and later.
Enhancements
This file includes the following enhancements.
| Issue key | Summary |
|---|---|
| GRD-124525 | Assessment Tests for Oracle 26ai based on latest CIS benchmarks. |
Vulnerability Assessment test enhancements
New query-based tests
| Test ID | Description |
|---|---|
| 4433 | Ensure BACKGROUND_CORE_DUMP Is Not Set To Full |
| 4434 | Ensure REMOTE_LOGIN_PASSWORDFILE Is Set To NONE |
| 4435 | Ensure RESOURCE_LIMIT Is Set To TRUE |
| 4436 | Ensure SHADOW_CORE_DUMP Is Not Set To Full |
| 4437 | Ensure MLE_PROG_LANGUAGES Is Set To OFF |
| 4438 | Ensure ALLOW_GROUP_ACCESS_TO_SGA Is Set To FALSE |
| 4439 | Ensure OS_ROLES Is Set To FALSE |
| 4440 | Ensure REMOTE_OS_ROLES Is Set To FALSE |
| 4441 | Ensure FAILED_LOGIN_ATTEMPTS Is Less Than Or Equal To 5 |
| 4442 | Ensure PASSWORD_VERIFY_FUNCTION Is Set For All Profiles |
| 4443 | Ensure PASSWORD_ROLLOVER_TIME Is set to 0 |
| 4444 | Ensure No Custom ORACLE_MAINTAINED Users Exist |
| 4445 | Ensure Old Password Versions Are Not Used |
| 4446 | Ensure The Latest Version of The Password File Is Used |
| 4447 | Ensure That Users In Different RAC Instances Are Identical In PW Files |
| 4448 | Ensure No Public Database Links Exist |
| 4449 | Ensure That Database Link Passwords Are Using The Latest Encryption |
| 4450 | Ensure All Auditable System Actions Commands Are Audited |
| 4451 | Ensure Critical Packages Are Audited |
| 4452 | Ensure All Export Activities Are Audited |
| 4453 | Ensure The Use Of SYS* Privileges Is Audited |
| 4454 | Ensure %ANY% Is Revoked from Unauthorized GRANTEE |
| 4455 | Ensure CREATE LIBRARY Is Revoked From Unauthorized GRANTEE |
| 4456 | Ensure Admin Privileges Are Revoked from Unauthorized GRANTEE |
| 4457 | Ensure IMPORT And EXPORT FULL DATABASE Is Revoked From Unauthorized GRANTEE |
| 4458 | Ensure CREATE EXTERNAL JOB Is Revoked From Unauthorized GRANTEE |
| 4459 | Ensure BECOME USER Is Revoked From Unauthorized GRANTEE |
| 4460 | Ensure TEXT DATASTORE ACCESS Is Revoked From Unauthorized GRANTEE |
| 4461 | Ensure CREATE, ALTER, And DROP PUBLIC DATABASE LINK Is Revoked From Unauthorized GRANTEE |
| 4462 | Ensure LOGMINING Is Revoked From Unauthorized GRANTEE |
| 4463 | Ensure JAVA_ADMIN Is Revoked From Unauthorized GRANTEE |
| 4464 | Ensure JAVASYSPRIVS Is Revoked From Unauthorized GRANTEE |
| 4465 | Ensure LOGSTDBY_ADMINISTRATOR Is Revoked From Unauthorized GRANTEE |
| 4466 | Ensure SQL_FIREWALL_ADMIN Is Revoked From Unauthorized GRANTEE |
| 4467 | Ensure MAINTPLAN_APP Is Revoked From Unauthorized GRANTEE |
| 4468 | Ensure JAVADEBUGPRIV Is Revoked From Unauthorized GRANTEE |
| 4469 | Ensure DV_PATCH_ADMIN Is Revoked From Unauthorized GRANTEE |
| 4470 | Ensure DV_POLICY_OWNER Is Revoked From Unauthorized GRANTEE |
| 4471 | Ensure AUDIT_ADMIN Is Revoked From Unauthorized GRANTEE |
| 4472 | Ensure AUDIT_VIEWER Is Revoked From Unauthorized GRANTEE |
| 4473 | Ensure EXP_FULL_DATABASE Is Revoked From Unauthorized GRANTEE |
| 4474 | Ensure PDB_DBA Is Revoked From Unauthorized GRANTEE |
| 4475 | Ensure SELECT_CATALOG_ROLE Is Revoked From Unauthorized GRANTEE |
| 4476 | Ensure EXECUTE_CATALOG_ROLE Is Revoked from Unauthorized GRANTEE |
| 4477 | Ensure IMP_FULL_DATABASE Is Revoked From Unauthorized GRANTEE |
| 4478 | Ensure DATAPUMP_EXP_FULL_DATABASE Is Revoked From Unauthorized GRANTEE |
| 4479 | Ensure DATAPUMP_IMP_FULL_DATABASE Is Not Revoked From Unauthorized GRANTEE |
| 4480 | Ensure DV_ADMIN Is Revoked From Unauthorized GRANTEE |
| 4481 | Ensure DV_AUDIT_CLEANUP Is Revoked From Unauthorized GRANTEE |
| 4482 | Ensure OLAP_DBA Is Revoked From Unauthorized GRANTEE |
| 4483 | Ensure LBAC_DBA Is Revoked From Unauthorized GRANTEE |
| 4484 | Ensure PASSWORD_LIFE_TIME + PASSWORD_GRACE_TIME Is Less Than Or Equal To 365 |
Updated query-based tests
| Test ID | Description |
|---|---|
| 2016 | Failed login attempts are limited |
| 2017 | SEC_PROTOCOL_ERROR_FURTHER_ACTION is set properly |
| 2018 | SEC_PROTOCOL_ERROR_TRACE_ACTION is set properly |
| 2203 | DBA Profile PASSWORD_GRACE_TIME Is Limited |
| 2204 | SEC_RETURN_SERVER_RELEASE_BANNER is set |
| 2309 | PASSWORD_REUSE_MAX is set |
| 2310 | PASSWORD_LOCK_TIME is set |
| 2312 | Default Accounts Password Changed - DBA_USERS_WITH_DEFPWD |
| 2373 | No Authorization To ALTER SYSTEM Privilege |
| 2378 | No Authorization To DBA Role |
| 2455 | Check Parameter REMOTE_LISTENER Setting |
| 2559 | Oracle system privilege granted to users and roles |
| 2743 | Ensure the LOGON AND LOGOFF Actions Audit is Enabled |
| 2879 | Ensure the INACTIVE_ACCOUNT_TIME Is Less than or Equal to 120 |
| 2880 | Ensure ALL Is Revoked on Sensitive Tables |
New groups
| Group ID | Description |
|---|---|
| 516 | Sharing applications credentials OS user |
| 517 | Home Servers |
| 518 | Allowed Client Countries |
| 519 | AI Workspace Activities (Claude) |
| 520 | AI Admin Actions (Claude) |
| 521 | AI Admin High-Risk Actions (Claude) |
| 522 | Sensitive File Paths |
| 523 | Critical Field Modification Tuple |
| 524 | UPDATE Commands |
| 525 | Suspicious Trigger Creation and Operations |
| 526 | Rename Statements |
| 527 | Constraint and Index Removal Commands |
| 528 | BACKUP DATABASE |
Resolved issues
| Issue key | Summary | APAR |
|---|---|---|
| GRD-132844 | Potential False-Positive of Test 656 – Password Length. Updated to align with the latest Oracle STIG requirements. The default password length threshold is increased from 8 to 15, and the test description is revised to reflect the Oracle STIG requirement. STIG references are updated accordingly. In addition, the test logic is enhanced to verify all profiles and functions, regardless of whether any users are currently associated with the profile. | DT499006 |
[{"Type":"MASTER","Line of Business":{"code":"LOB76","label":"Data Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSDKGA","label":"IBM Guardium Data Protection"},"ARM Category":[{"code":"a8m0z000000cvkbAAA","label":"DPS"},{"code":"a8m3p000000PCTuAAO","label":"Platform\/Installation\/Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"12.2.4"}]
Was this topic helpful?
Document Information
Modified date:
16 October 2026
UID
ibm17288588