Answer:

I believe you will need to use dynamic sql to achieve this (dbms_sql). For
example, this is a procedure from a package that I have been using which
works OK (it may not be most elegant but it does the job for now).

procedure update_password
     (p_username  in varchar2,
      p_password  in varchar2,
      p_return_code out varchar2)

is

v_c  number;
v_sql  varchar2(2000);

begin

  begin
    v_sql := 'alter user '||p_username||' identified by '||p_password;
    v_c := dbms_sql.open_cursor;
    dbms_sql.parse(v_c,v_sql,dbms_sql.v7);
    dbms_sql.close_cursor(v_c);
  exception
    when others then
      p_return_code := sqlerrm(sqlcode);
      return;
  end;

  p_return_code := null;

end update_password;