CSSCAN for the character set change, database version 11.2.0.3.0
You can just edit the file $ORACLE_HOME/rdbms/admin/csminst.sql and change identified by csmig from csmig to a more complex password; you may have to enclose the password with double quotes if you have characters other than alphanumeric, underscore (_), dollar sign ($) or pound/hash sign (#).

Example:

create user csmig identified by "W#$!?X8Y" password expire account lock;