Database security with PUBLIC EXECUTE privileges for Application Express

Question

I recently tried installing APEX into an existing database containing a data warehouse. Security on this database is quite controlled and PUBLIC EXECUTE to SYS owned objects had been removed. Ie there was no PUBLIC EXECUTE on:
DBMS_LOB
UTL_HTTP
UTL_FILE
UTL_SMTP
UTL_RAW.
When I tried to install APEX, I got all kinds of errors and logged a TAR. The analyst told me to grant execute to public to the above SYS owned objects. This contradicts the "Policies" in 10G Grid control and the Metalink Notes 131752.1 &
Note:247093.1.
Can these execute privileges be changed to another user in the htmlDB
application such as FLOWS_FILES? Or HTMLDB_PUBLIC_USER? What is the security reccomendations for Oracle Application Express? Calling any product managers out there....

Answer 1

Developers/users have started clicking around and are now getting errors. There is a function called CUSTOM_AUTH and one called CUSTOM_HASH which do not compile. They have complain about not seeing UTL_RAW so had been relying on PUBLIC synonyms. here's the 1 function:
create or replace function custom_hash (p_username in varchar2, p_password in varchar2)
                         return varchar2
                         is
                         l_password varchar2(4000);
                         l_salt varchar2(4000) := '2ZVKZMILYMGVFRFXOZIVZ72RJNJY8V';
                         begin
                         -- This function should be wrapped, as the hash algorhythm is exposed here.
                         -- You can change the value of l_salt or the method of which to call the
                         -- DBMS_OBFUSCATOIN toolkit, but you much reset all of your passwords
                         -- if you choose to do this.
                         l_password := utl_raw.cast_to_raw(dbms_obfuscation_toolkit.md5
                         (input_string => p_password || substr(l_salt,10,13) || p_username ||
                         substr(l_salt, 4,10)));
                         return l_password;
                         end;