Oracle Database 11 g - Online Public Access Catalog

234 CHAPTER 5 ■ DATABASE SECURITYBecause database link passwords are stored in uppercase, the password in Oracle Database 11gshould be set with uppercase.Now let’s see what kind of implications there are to initiate the database link from OracleDatabase 11g to an older version of Oracle. Since Oracle Database 11g Release 1 is the firstrelease to use password sensitivity, you do not have to worry about case sensitivity whencreating database links to a prior release of Oracle.Password ManagementIn previous releases, if a hacker has select access to the DBA_USERS view, the hacker can easilycrack another user’s password if the passwords are weak. Hackers can create a copy of theDBA_USERS view to a local database and perform an offline attack. Hackers can create a databaseaccount for username entries in the DBA_USERS view and can compare the hash value ofthe password column in the local DBA_USERS view with the production copy of the DBA_USERSview. There are various ways to determine passwords. One common practice is to comparepasswords with millions of words in the dictionary to exploit weak passwords. Another commonpractice is to generate random alphanumeric passwords such as Oracle’s RANDOM function andcompare hash values.Luckily, Oracle provides another level of security to the underlying data dictionary. TheDBA_USERS view in Oracle Database 11g has the password column blanked out. The followingquery confirms that the password column no longer provides the hashed value of the password:SQL> select username, password from dba_users order by username;USERNAMEPASSWORD----------------------- ------------------------------ANONYMOUSAPEX_PUBLIC_USERBICKIMCTXSYSDBSNMPDIPDSONGDSWEET......To obtain the hashed value of the encrypted password, you will need to have the selectprivilege on the USER$ table instead. Database users do not receive select privileges against theUSER$ table via the SELECT_CATALOG_ROLE role. One of the ways to grant access to the USER$ tableis by granting the SELECT ANY DICTIONARY role to the database account.Here is the simple query of the USER$ table to view the hashed password values:SQL> select name, password from user$;