db-derby-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Myrna van Lunteren (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (DERBY-6632) Applications may be able to use StorageFactoryService to delete Derby databases and overwrite service.properties.
Date Wed, 01 Oct 2014 17:45:33 GMT

    [ https://issues.apache.org/jira/browse/DERBY-6632?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14155179#comment-14155179
] 

Myrna van Lunteren commented on DERBY-6632:
-------------------------------------------

I marked this as backport reject 10_11 because there are no commits associated with it to
be backported.

> Applications may be able to use StorageFactoryService to delete Derby databases and overwrite
service.properties.
> -----------------------------------------------------------------------------------------------------------------
>
>                 Key: DERBY-6632
>                 URL: https://issues.apache.org/jira/browse/DERBY-6632
>             Project: Derby
>          Issue Type: Bug
>          Components: Services
>    Affects Versions: 10.11.1.1
>            Reporter: Rick Hillegas
>              Labels: derby_backport_reject_10_11
>             Fix For: 10.12.0.0
>
>
> Various powerful methods in StorageFactoryService are public. I have not verified the
following with an experiment, but it appears to me that these methods give any code running
in the JVM the ability to elevate privileges to those granted to Derby and do the following:
> 1) Delete Derby databases via the following methods:
> {noformat}
> org.apache.derby.impl.services.monitor.StorageFactoryService createServiceRoot()
> org.apache.derby.impl.services.monitor.StorageFactoryService getServiceProperties()
> org.apache.derby.impl.services.monitor.StorageFactoryService getStorageFactoryInstance()
> org.apache.derby.impl.services.monitor.StorageFactoryService removeServiceRoot()
> {noformat}
> 2) Overwrite service.properties via overloads of the following method:
> {noformat}
> org.apache.derby.impl.services.monitor.StorageFactoryService createServiceRoot()
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message