MIME-Version: 1.0
References: <CAG8xnice5pQEGnp6qhSYP9BvwzzdqJYM_xYkBFdRWWvCwP1VAg@mail.gmail.com>
In-Reply-To: <CAG8xnice5pQEGnp6qhSYP9BvwzzdqJYM_xYkBFdRWWvCwP1VAg@mail.gmail.com>
From: Andy Klock <andy@oracledepot.com>
Date: Sun, 3 Mar 2019 08:39:30 -0500
Message-ID: <CADo_RaPpnLQHnSX4SPaFN=6-_CAWxc25Dprhn=Of0n6VOwBVFQ@mail.gmail.com>
Subject: Re: Fun with ALTER_USER
To: Gus Spier <gus.spier@gmail.com>
Cc: oracle-l <oracle-l@freelists.org>
Content-Type: multipart/alternative; boundary="000000000000bbb5aa058330c544"
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-To: andy@oracledepot.com
--000000000000bbb5aa058330c544
Content-Type: text/plain; charset="UTF-8"

On Thu, Feb 28, 2019 at 3:26 PM Gus Spier <gus.spier@gmail.com> wrote:

>
> It fell in my lap to produce the tool. It certainly seems that it should
> work. But I suspect there are complications with which I am unfamiliar.
>
>
Apart from Dynamic SQL being the devil and me not wanting to rain on your
fun, this all looks like a really bad idea. I like that management is
trying to address a common attack vector, but this tool is opening ways to
hand passwords to would-be attackers.  If the connection from the client to
the database isn't encrypted then the password is going over the wire in
clear text. And since it is being passed into a bind variable then it is
sitting in the SGA in clear text. (Meaning, anyone with SELECT ANY
DICTIONARY, regardless of who they are what their role is, can possibly see
it).

The best tool for changing passwords is sqlplus. (But you probably already
knew that :) ) It validates that the old password is known and that the new
password has been typed in correctly twice. The new password is never sent
or stored clear text, so dramatically more secure. Time would be better
spent writing a function that validates that the new password conforms to
your company policy.

https://docs.oracle.com/database/121/DBSEG/authentication.htm#GUID-38B80221-55AE-4928-9AC0-4CAFFD5A4E96

And hopefully your DEVs are using wallets :)

Sorry about being a bummer.

Andy K

--000000000000bbb5aa058330c544
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><br></div><div class=3D"=
gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Feb 28, 2019 at =
3:26 PM Gus Spier &lt;<a href=3D"mailto:gus.spier@gmail.com">gus.spier@gmai=
l.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:=
1ex"><div dir=3D"ltr"><div dir=3D"ltr"><div><br></div><div>It fell in my la=
p to produce the tool. It certainly seems that it should work. But I suspec=
t there are complications with which I am unfamiliar.</div><div><br></div><=
/div></div></blockquote><div><br></div><div>Apart from Dynamic SQL being th=
e devil and me not wanting to rain on your fun, this all looks like a reall=
y bad idea. I like that management is trying to address a common attack vec=
tor, but this tool is opening ways to hand passwords to would-be attackers.=
=C2=A0=C2=A0If the connection from the client to the database isn&#39;t enc=
rypted then the password is going over the wire in clear text. And since it=
 is being passed into a bind variable then it is sitting in the SGA in clea=
r text. (Meaning, anyone with SELECT ANY DICTIONARY, regardless of who they=
 are what their role is, can possibly see it).</div><div><br></div><div>The=
 best tool for changing passwords is sqlplus. (But you probably already kne=
w that :) ) It validates that the old password is known and that the new pa=
ssword has been typed in correctly twice. The new password is never sent or=
 stored clear text, so dramatically more secure. Time would be better spent=
 writing a function that validates that the new password conforms to your c=
ompany policy.</div><div><br></div><div><a href=3D"https://docs.oracle.com/=
database/121/DBSEG/authentication.htm#GUID-38B80221-55AE-4928-9AC0-4CAFFD5A=
4E96">https://docs.oracle.com/database/121/DBSEG/authentication.htm#GUID-38=
B80221-55AE-4928-9AC0-4CAFFD5A4E96</a><br></div><div><br></div><div>And hop=
efully your DEVs are using wallets :)=C2=A0</div><div><br></div><div>Sorry =
about being a bummer.</div><div><br></div><div>Andy K</div></div></div></di=
v>

--000000000000bbb5aa058330c544--
--
http://www.freelists.org/webpage/oracle-l