Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> case sensitive password in 9i / 11g
        
(Message started by: Pete Finnigan on Sep 14^th, 2007, 1:52pm)

Title: case sensitive password in 9i / 11g
Post by Pete Finnigan on Sep 14^th, 2007, 1:52pm

Hi,
Could you explain me that phenomena ?

I have LSC02 is 9i and LSC08 is 11g

I have user u with password xXx on 11g and password XXX on 9i

I have a db link with no password from 9i to 11g.

The db link works only when the 9i user is connected by xXx.

As 9i is case insensitive, I wonder how 9i can remember the password was xXx or XxX ???

here is the test case

Code:

SQL> connect u/xxx@lsc02
Connected.
SQL>
SQL> create database link lsc08 using 'LSC08';

Database link created.

SQL> select * from t@lsc08;
select * from t@lsc08
*
ERROR at line 1:
ORA-01017: invalid username/password; logon denied
ORA-02063: preceding line from LSC08

SQL> connect u/XXX@lsc02
Connected.
SQL> select * from t@lsc08;
select * from t@lsc08
*
ERROR at line 1:
ORA-01017: invalid username/password; logon denied
ORA-02063: preceding line from LSC08

SQL> connect u/xXx@lsc02
Connected.
SQL> select * from t@lsc08;

no rows selected

Title: Re: case sensitive password in 9i / 11g
Post by Pete Finnigan on Sep 17^th, 2007, 8:41am

Hi Laurent,

A 9i database knows about the case sensitive password because of the way the 03logon protocol works in 9i. I have talked about this a number of times and mentioned a paper by laszlo Toth about this most recently. basically the client hashes the username/password, the username is sent to the server, the server encrypts a session key with the hash, the client then decrypts the session key with its copy of the hash and then uses the session key to encrypt the clear text password and sends it to the server - hence 9i can send a case sensitive password to 11g.

The fix for your problem is to re-create the user "u" password as all upper case - see http://download.oracle.com/docs/cd/B28359_01/network.111/b28531/authentication.htm#sthref232 for details.

cheers

Pete

Title: Re: case sensitive password in 9i / 11g
Post by Pete Finnigan on Sep 17^th, 2007, 9:18am

Thank you!