[DERBY-5510] It is easy to override authentication, authorization, and database-only properties if you have physical access to a database.

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 10.9.1.0
• Component/s: Miscellaneous
• Labels: derby_triage10_10
• Urgency: Normal
• Bug behavior facts: Security
• Assignee: Unassigned
• Reporter: Richard N. Hillegas
• Created: 22/Nov/11 19:04
• Updated: 28/Sep/12 00:21

Description

If you have write access to the directory containing a Derby database, then the following easy exploit will let you change the contents of the database and possibly evade detection for some time:

1) Create a vacuous dummy database with this ij command:

connect 'jdbc:derby:dummydb;create=true';

2) Copy the properties conglomerate (c10.dat) from the target database to a side location.

3) Now copy the vacuous c10.dat from dummydb into the seg0 directory of the target database.

4) Now connect to the target database with the following ij command and change anything you want:

connect 'jdbc:derby:targetdb';

5) When you are done, copy c10.dat from the side location back into the seg0 directory of the target database.

I do not regard this as a new vulnerability. That is because once you have write access to a Derby database directory, you have unlimited power to change and corrupt the database. However, I am filing this JIRA so that we will have a name for this particular easy exploit.