Uploaded image for project: 'Derby'
  1. Derby
  2. DERBY-5510

It is easy to override authentication, authorization, and database-only properties if you have physical access to a database.

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 10.9.1.0
    • Fix Version/s: None
    • Component/s: Miscellaneous
    • Urgency:
      Normal
    • Bug behavior facts:
      Security

      Description

      If you have write access to the directory containing a Derby database, then the following easy exploit will let you change the contents of the database and possibly evade detection for some time:

      1) Create a vacuous dummy database with this ij command:

      connect 'jdbc:derby:dummydb;create=true';

      2) Copy the properties conglomerate (c10.dat) from the target database to a side location.

      3) Now copy the vacuous c10.dat from dummydb into the seg0 directory of the target database.

      4) Now connect to the target database with the following ij command and change anything you want:

      connect 'jdbc:derby:targetdb';

      5) When you are done, copy c10.dat from the side location back into the seg0 directory of the target database.

      I do not regard this as a new vulnerability. That is because once you have write access to a Derby database directory, you have unlimited power to change and corrupt the database. However, I am filing this JIRA so that we will have a name for this particular easy exploit.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              rhillegas Rick Hillegas
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated: