Oracle Releases Password Security Tool

Oracle has released a tool designed to ferret out commonly used default passwords that theoretically could be misused by hackers. Called the Oracle Default Password Scanner, the software was released Tuesday as part of Oracle’s quarterly Critical Patch Update.

Earlier versions of Oracle’s database software included well-known default passwords and user names, such as “scott/tiger.” These accounts are also known to have been created by other software, such as application servers, that interact with the database, said Oracle Security Alerts Manager Darius Wiles.

Although these accounts have been locked down in current versions of the database, they may present a problem to some users with older versions of the database or to those who have upgraded from an older version that included the default passwords, he added.

Oracle 10g databases that have been upgraded from Oracle 7, Oracle8i or Oracle9i may include the default accounts, according to a note accessible to subscribers of Oracle’s MetaLink support service.

The password scanner is a SQL script that scans the database and then prints out the names of these well-known accounts if they are unlocked, Wiles said. “This tool is designed to catch those instances and then explain to customers the right thing to do to secure their systems.”

Subscribers to MetaLink can find more information on the Default Password Scanner in MetaLink Note 361482.1.

More information on Oracle’s Critical Patch Update can be found online.

-Robert McMillan, IDG News Service

For related news coverage, read Oracle Offers Fix for Database, Apps and Oracle Lays Out Telecom Service Delivery Platform.

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.