[DERBY-6635] OptimizerTracer.unloadTool() could be used to write garbage over Derby data files.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.11.1.1
• Fix Version/s: 10.11.1.3, 10.12.1.1
• Component/s: Tools
• Urgency: Normal
• Bug behavior facts: Security
• Assignee: Richard N. Hillegas
• Reporter: Richard N. Hillegas
• Created: 23/Jun/14 18:13
• Updated: 09/Sep/16 09:51
• Resolved: 03/Oct/14 12:46

Description

I don't see any checks in place to prevent this method from writing its output file into the log or sego directories or even over service.properties. Fortunately, only the DBO can run this procedure by default.