From: | Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> |
---|---|
To: | David(dot)Daney(at)avtrex(dot)com, pgsql-bugs(at)postgresql(dot)org |
Cc: | PostgreSQL jdbc list <pgsql-jdbc(at)postgresql(dot)org> |
Subject: | Re: Bug #428: Another security issue with the JDBC driver. |
Date: | 2001-08-24 19:10:56 |
Message-ID: | 200108241910.f7OJAu419957@candle.pha.pa.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs pgsql-jdbc pgsql-patches |
Your patch has been added to the PostgreSQL unapplied patches list at:
http://candle.pha.pa.us/cgi-bin/pgpatches
I will try to apply it within the next 48 hours.
> David Daney (David(dot)Daney(at)avtrex(dot)com) reports a bug with a severity of 3
> The lower the number the more severe it is.
>
> Short Description
> Another security issue with the JDBC driver.
>
> Long Description
> The JDBC driver requires
>
> permission java.net.SocketPermission "host:port", "connect";
>
> in the policy file of the application using the JDBC driver
> in the postgresql.jar file. Since the Socket() call in the
> driver is not protected by AccessController.doPrivileged() this
> permission must also be granted to the entire application.
>
> The attached diff fixes it so that the connect permission can be
> restricted just the the postgresql.jar codeBase if desired.
>
> Sample Code
> *** PG_Stream.java.orig Fri Aug 24 09:27:40 2001
> --- PG_Stream.java Fri Aug 24 09:42:14 2001
> ***************
> *** 5,10 ****
> --- 5,11 ----
> import java.net.*;
> import java.util.*;
> import java.sql.*;
> + import java.security.*;
> import org.postgresql.*;
> import org.postgresql.core.*;
> import org.postgresql.util.*;
> ***************
> *** 27,32 ****
> --- 28,52 ----
> BytePoolDim1 bytePoolDim1 = new BytePoolDim1();
> BytePoolDim2 bytePoolDim2 = new BytePoolDim2();
>
> + private static class PrivilegedSocket
> + implements PrivilegedExceptionAction
> + {
> + private String host;
> + private int port;
> +
> + PrivilegedSocket(String host, int port)
> + {
> + this.host = host;
> + this.port = port;
> + }
> +
> + public Object run() throws Exception
> + {
> + return new Socket(host, port);
> + }
> + }
> +
> +
> /**
> * Constructor: Connect to the PostgreSQL back end and return
> * a stream connection.
> ***************
> *** 37,43 ****
> */
> public PG_Stream(String host, int port) throws IOException
> {
> ! connection = new Socket(host, port);
>
> // Submitted by Jason Venner <jason(at)idiom(dot)com> adds a 10x speed
> // improvement on FreeBSD machines (caused by a bug in their TCP Stack)
> --- 57,69 ----
> */
> public PG_Stream(String host, int port) throws IOException
> {
> ! PrivilegedSocket ps = new PrivilegedSocket(host, port);
> ! try {
> ! connection = (Socket)AccessController.doPrivileged(ps);
> ! }
> ! catch(PrivilegedActionException pae){
> ! throw (IOException)pae.getException();
> ! }
>
> // Submitted by Jason Venner <jason(at)idiom(dot)com> adds a 10x speed
> // improvement on FreeBSD machines (caused by a bug in their TCP Stack)
>
>
> No file was uploaded with this report
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 5: Have you checked our extensive FAQ?
>
> http://www.postgresql.org/users-lounge/docs/faq.html
>
--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 853-3000
+ If your life is a hard drive, | 830 Blythe Avenue
+ Christ can be your backup. | Drexel Hill, Pennsylvania 19026
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2001-08-24 19:52:31 | Re: timestamps cannot be created without time zones |
Previous Message | Tomasz Zielonka | 2001-08-24 17:24:51 | Re: Strange deadlock problem on simple concurrent SELECT/LOCK TABLE transactions |
From | Date | Subject | |
---|---|---|---|
Next Message | Laurette Cisneros | 2001-08-24 19:23:33 | timestamps and java epochs |
Previous Message | Ned Wolpert | 2001-08-24 18:12:23 | Re: Re: [JDBC] New backend functions? |
From | Date | Subject | |
---|---|---|---|
Next Message | Peter Eisentraut | 2001-08-24 19:29:06 | Re: [PATCHES] encoding names |
Previous Message | Mikhail Terekhov | 2001-08-24 18:25:34 | Re: [HACKERS] Re: WIN32 errno patch |