Oracle: Policies can protect passwords

In response to criticism published by two researchers last week that the protection mechanism for Oracle database user passwords is weak, Oracle is reminding users to apply good password protection policies.

"We feel strongly that the issues noted in the paper can be addressed through good password policy management, which dramatically reduces the inherent security risks associated with any password-based authentication system, and through use of security features included with the Oracle database, such as facilities to enforce password complexity, account lockout after multiple login failures and password expiration," Oracle said in a statement sent via e-mail late Friday.

The experts called on the software maker to improve the mechanism used to secure passwords for database users. They said they found a way to recover the plain text password from even very strong, well-written Oracle database passwords within minutes. (Download PDF of their paper.)

"The paper published by SANS exposes the location in the Oracle data dictionary where the Oracle password hashes are stored. By default, access to this table is restricted to a limited number of highly privileged database users," Oracle said. "Good enterprise password policies will dramatically reduce the inherent security risks associated with any password-based authentication system."

The database password security is the latest critique of Oracle's security practices. The software maker is also under fire for tardiness in patching security flaws and delivering faulty security updates.

About the author

    Joris Evers covers security.

     

    Join the discussion

    Conversation powered by Livefyre

    Show Comments Hide Comments
    Latest Galleries from CNET
    The best and worst quotes of 2014 (pictures)
    A roomy range from LG (pictures)
    This plain GE range has all of the essentials (pictures)
    Sony's 'Interview' heard 'round the world (pictures)
    Google Lunar XPrize: Testing Astrobotic's rover on the rocks (pictures)
    CNET's 15 favorite How Tos of 2014