You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Daniel John Debrunner (JIRA)" <ji...@apache.org> on 2007/08/17 18:26:31 UTC
[jira] Created: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
---------------------------------------------------------------------------------------------------------------------------
Key: DERBY-3014
URL: https://issues.apache.org/jira/browse/DERBY-3014
Project: Derby
Issue Type: Improvement
Components: Security
Reporter: Daniel John Debrunner
Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "R VIDYA LAKSHMI (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
R VIDYA LAKSHMI updated DERBY-3014:
-----------------------------------
Derby Info: [Patch Available]
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Dyre Tjeldvoll (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Dyre Tjeldvoll updated DERBY-3014:
----------------------------------
Derby Info: (was: [Patch Available])
I'm removing 'patch available' since another rev of the patch has been requested by a reviewer
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12568971#action_12568971 ]
Daniel John Debrunner commented on DERBY-3014:
----------------------------------------------
I'm not sure that returning a value for a defined user is a good idea. This means the method now indicates if a user name is valid or not which is more information for an attacker. Now this function is under the control of the database owner so maybe it's ok, but it's a very generic function, so at least the documentation for it should indicate that allowing others to run this exposes sensitive security information.
If it returned NULL than an additional function to determine is a user is valid in the BUILTIN scheme could be added. With that it would be more obvious to the database owner the danger of granting execute permission to others.
There may also be other ways to detemine valid users, but those might get closed in future releases, so with this change it's a good chance to get it right now.
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Kathey Marsden (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Kathey Marsden reassigned DERBY-3014:
-------------------------------------
Assignee: (was: R VIDYA LAKSHMI)
Unassigning due to inactivity. Please reassign yourself if you would like to work on this issue.
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "R VIDYA LAKSHMI (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
R VIDYA LAKSHMI reassigned DERBY-3014:
--------------------------------------
Assignee: R VIDYA LAKSHMI
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12568975#action_12568975 ]
Daniel John Debrunner commented on DERBY-3014:
----------------------------------------------
Also some tests would be good to ensure the functionality does not regress in the future.
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Jazarine Jamal (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12568558#action_12568558 ]
Jazarine Jamal commented on DERBY-3014:
---------------------------------------
A call to SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') property returns NULL evenn if the <username> does not exist.
So, I was thinking if the system function returns a ****** instead of null.
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Dag H. Wanvik (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Dag H. Wanvik updated DERBY-3014:
---------------------------------
Component/s: Services
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Services
> Reporter: Daniel John Debrunner
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12569000#action_12569000 ]
Daniel John Debrunner commented on DERBY-3014:
----------------------------------------------
In the patch this code:
key.substring(0,11).equals("derby.user.")
is really does the key start with "derby.user." Java's String class already has a method that implements this, 'startsWith'
thus the code can be simplified to
key.startsWith("derby.user.")
With Java it's good to read the javadoc of any classes you are using, typically any functionality you need already exists.
Then software projects usually have defined constants for any literals they need (e.g. Strings and ints). This has several benefits, changing the value of the constant requires change in one place, a defined constant provides more information that just the literal (e..g READ_COMMITTED instead of 2) when used, finding out which code depends on the constant can be a search on the defined constant instead of the value. Imagine trying to find all code that depended on the literal 2 when 2 might represent different concepts in different contexts, searching for READ_COMMITTED is much easier.
So in the class org.apache.derby.iapi.reference.Property a defined constant already exist: USER_PROPERTY_PREFIX which then changes the code to:
key.startsWith(Property.USER_PROPERTY_PREFIX )
There are a couple of ways to find such constants:
- search through the code and thus gain some more understanding of the code
- ask a question on derby-dev, folks will be happy to point others in the right direction
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12568972#action_12568972 ]
Daniel John Debrunner commented on DERBY-3014:
----------------------------------------------
On the patch, a comment should be added indicating why a different value is being returned (regardless of if null or *** is seelcted).
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-3014) Make
SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.') return
NULL instead of the hash value of the password
Posted by "R VIDYA LAKSHMI (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-3014?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
R VIDYA LAKSHMI updated DERBY-3014:
-----------------------------------
Attachment: DERBY-3014.diff
Instead of returning null, we made the function to return " ******* " in accordance with the previous comment.
Please refer the diff file for further information.
> Make SYSCS_UTIL.SYSCS_GET_DATABASE_PROPERTY('derby.user.<username>') return NULL instead of the hash value of the password
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-3014
> URL: https://issues.apache.org/jira/browse/DERBY-3014
> Project: Derby
> Issue Type: Improvement
> Components: Security
> Reporter: Daniel John Debrunner
> Assignee: R VIDYA LAKSHMI
> Attachments: DERBY-3014.diff
>
>
> Increases security by providing less information to any attacker. The current returned hash value could be used in an off-line dictionary based attack to find a valid password.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.