DBSecWorx: DBMS_PSWMG

Oracle DBMS_PSWMG_IMPORT Built-In Package Versions ? - 19.3

Security Advisory

Some pages here in the Code Library are included because they are an identified vulnerability or because there are known exploits. Others, such as this page, are included because we know that they, in some manner, impact system security. The potential impact is clear when you look at the dependencies list below which includes the data dictionary table USER_HISTORY$.

SQL> desc user_history$

      Name           Null?    Type

      -------------- --------  --------------

      USER#          NOT NULL NUMBER

      PASSWORD                VARCHAR2(4000)

      PASSWORD_DATE           DATE

And the security model which includes grants of EXECUTE to the EXP_FULL_DATABASE and IMP_FULL_DATABASE roles.

Our unverified suspicion is that it is used by DataPump and impacts the transfer, between databases, of password history and the password verify function.

Recommended Security Rules

NEVER

Never grant EXECUTE on this package to anyone. It is officially undocumented and unsupported and is known to, in so affect some aspect of password history retention

WITH GREAT CARE

CAUTIONS

How Oracle Works

We do not know enough about this package to provide specific guidance.

DBMS_PSWMG_IMPORT Package Information

AUTHID DEFINER

Dependencies

DBMS_ASSERT	DBMS_STANDARD	USER_HISTORY$
DBMS_SQL	USER$

Documented No

Data Types TYPE arrayOfHistoryRecords ....

Documented No

First Available Known to exist in 12.1 through 19.3. Likely has existed in many previous versions.

Security Model Owned by SYS with EXECUTE granted to the EXP_FULL_DATABASE and IMP_FULL_DATABASE roles.

Source {ORACLE_HOME}/rdbms/admin/prvtxpsw.plb

Subprograms

Import Password History dbms_pswmg_import.import_history( history_recs IN dbms_pswmg_import.arrayOfHistoryRecords, num_recs IN NUMBER);

TBD

IMPORT_PSW_VERIFY_FN

Imports the Password Verify Function dbms_pswmg_import.import_psw_verify_fn( profile_name IN VARCHAR2, function_name IN VARCHAR2, function_body IN VARCHAR2);

TBD

PURGE_HISTORY

Purge Password History dbms_pswmg_import.purge_history(username IN VARCHAR2);

exec dbms_pswmg_import.purge_history('UWCLASS');

      

      PL/SQL procedure successfully completed.