[JBoss JIRA] Updated: (JBAS-2243) UsernamePassword/DatabaseServerLoginModule reveal to much information
by Dimitris Andreadis (JIRA)
[ http://jira.jboss.com/jira/browse/JBAS-2243?page=all ]
Dimitris Andreadis updated JBAS-2243:
-------------------------------------
Fix Version/s: (was: JBossAS-4.0.5.GA)
> UsernamePassword/DatabaseServerLoginModule reveal to much information
> ---------------------------------------------------------------------
>
> Key: JBAS-2243
> URL: http://jira.jboss.com/jira/browse/JBAS-2243
> Project: JBoss Application Server
> Issue Type: Feature Request
> Security Level: Public(Everyone can see)
> Components: Security
> Affects Versions: JBossAS-4.0.3RC2
> Environment: 4.0.3RC2/EJB3
> Reporter: Jens Elkner
>
> If an authentication fails, the thrown javax.security.auth.login.FailedLoginException has a detailed message, which says "Password Incorrect/Password Required" or "No matching username found in Principals". These are pretty good information for an attacker, since than it knows, where to continue its attack and is able to skip a lot of tasks (no matter, whether it comes from the internal or external network - in our days, attacks from internal is probably the most common case).
> Actually, that's also the reason, why many authentication systems just insert even a delay to not let the attacker guess, whether the guessed username was wrong or the guessed password (minimal, but measurable delay dueto en/decryption) ...
> So, logging those details might be ok, but revealing those infos to the client is without any doubt a security issue!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
19 years, 8 months
[JBoss JIRA] Updated: (JBAS-2133) use left join in jboss-3.2.7 with oracle8.1.7.0.1
by Dimitris Andreadis (JIRA)
[ http://jira.jboss.com/jira/browse/JBAS-2133?page=all ]
Dimitris Andreadis updated JBAS-2133:
-------------------------------------
Issue Type: Feature Request (was: Bug)
Fix Version/s: JBossAS-4.0.6.CR1
(was: JBossAS-4.0.5.GA)
> use left join in jboss-3.2.7 with oracle8.1.7.0.1
> -------------------------------------------------
>
> Key: JBAS-2133
> URL: http://jira.jboss.com/jira/browse/JBAS-2133
> Project: JBoss Application Server
> Issue Type: Feature Request
> Security Level: Public(Everyone can see)
> Components: CMP service
> Affects Versions: JBossAS-3.2.7 Final
> Environment: fedora core 3 ,jrockit 1.4.2_05
> Reporter: peixubin
> Fix For: JBossAS-4.0.6.CR1
>
>
> I have this jbossquery:
> <query-method>
> <method-name>findByCounte</method-name>
> <method-params>
> <method-param>java.lang.String</method-param>
> </method-params>
> </query-method>
> <jboss-ql><![CDATA[SELECT OBJECT(o) FROM JhFyck o WHERE o.counte.name=?1]]></jboss-ql>
> <read-ahead>
> on-find
> <eager-load-group>*</eager-load-group>
> <left-join cmr-field="jhFyk" eager-load-group="*"/>
> </read-ahead>
> while I execute this find method,the console print errors:
> 10:35:44,374 DEBUG [JhFyck#findByCounte] Executing SQL: SELECT t0_o.PKID, t0_o.FYLX, t0_o.RKSJ, t0_o.RKR, t0_o.CWM, t0_o.FYH, t0_o.FYK, t0_o.RKPC, t0_o.RCPC, t0_o.ZT, t0_o.BFR, t0_o.BFSJ, t1 _o_jhFyk.PKID, t1_o_jhFyk.P_PKID, t1_o_jhFyk.MC, t1_o_jhFyk.BM, t1_o_jhFyk.X, t1_o_jhFyk.Y, t1_ o_jhFyk.ZT FROM PXB.JH_FYCK t0_o, YD.COUNTE t2_o_counte, JH_COUNTE_FY t3_o_counte_RELATION_TABLE LEFT OUTER JOIN PXB.JH_FYK t1_o_jhFyk ON t0_o.FYK=t1_o_jhFyk.PKID WHERE (t2_o_counte.NAME = ? AND t0_o.PKID=t3_o_counte_RELATION_TABLE.FYBH AND t2_o_counte.NAME=t3_o_counte_RELATION_TABLE. COUNTE)
> 10:35:44,405 ERROR [JhFyck#findByCounte] Find failed
> java.sql.SQLException: ORA-00933: SQL command not properly ended
> at oracle.jdbc.dbaccess.DBError.throwSqlException(Ljava.lang.String;Ljava.lang.String;I )V(DBError.java:168)
> at oracle.jdbc.ttc7.TTIoer.processError()V(TTIoer.java:208)
> at oracle.jdbc.ttc7.Oall7.receive()V(Oall7.java:543)
> at oracle.jdbc.ttc7.TTC7Protocol.doOall7(BBI[B[Loracle.jdbc.dbaccess.DBType;[Loracle.jd bc.dbaccess.DBData;I[Loracle.jdbc.dbaccess.DBType;[Loracle.jdbc.dbaccess.DBData;I)V(TTC7Protoco l.java:1405)
> at oracle.jdbc.ttc7.TTC7Protocol.parseExecuteDescribe(Loracle.jdbc.dbaccess.DBStatement ;[BLoracle.jdbc.dbaccess.DBDataSet;)[Loracle.jdbc.dbaccess.DBColumn;(TTC7Protocol.java:643)
> at oracle.jdbc.driver.OracleStatement.doExecuteQuery()V(OracleStatement.java:1674)
> at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout()V(OracleStatement.java:1870 )
> at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate()I(OraclePreparedStatement. java:363)
> at oracle.jdbc.driver.OraclePreparedStatement.executeQuery()Ljava.sql.ResultSet;(Oracle PreparedStatement.java:314)
> at org.jboss.resource.adapter.jdbc.WrappedPreparedStatement.executeQuery()Ljava.sql.Res ultSet;(WrappedPreparedStatement.java:314)
> at org.jboss.ejb.plugins.cmp.jdbc.JDBCAbstractQueryCommand.execute(Ljava.lang.String;[L java.lang.Object;IILorg.jboss.ejb.plugins.cmp.jdbc.bridge.JDBCEntityBridge;Lorg.jboss.ejb.plugi ns.cmp.jdbc.bridge.JDBCCMPFieldBridge;Lorg.jboss.ejb.plugins.cmp.ejbql.SelectFunction;Lorg.jbos s.ejb.plugins.cmp.jdbc.JDBCStoreManager;[ZLjava.util.List;Ljava.util.List;Lorg.jboss.ejb.plugin s.cmp.jdbc.metadata.JDBCQueryMetaData;Lorg.jboss.ejb.GenericEntityObjectFactory;Lorg.jboss.logg ing.Logger;)Ljava.util.Collection;(JDBCAbstractQueryCommand.java:226)
> at org.jboss.ejb.plugins.cmp.jdbc.JDBCAbstractQueryCommand.execute(Ljava.lang.reflect.M ethod;[Ljava.lang.Object;Lorg.jboss.ejb.EntityEnterpriseContext;Lorg.jboss.ejb.GenericEntityObj ectFactory;)Ljava.util.Collection;(JDBCAbstractQueryCommand.java:128)
> at org.jboss.ejb.plugins.cmp.jdbc.JDBCFindEntitiesCommand.execute(Ljava.lang.reflect.Me thod;[Ljava.lang.Object;Lorg.jboss.ejb.EntityEnterpriseContext;Lorg.jboss.ejb.GenericEntityObje ctFactory;)Ljava.util.Collection;(JDBCFindEntitiesCommand.java:40)
> at org.jboss.ejb.plugins.cmp.jdbc.JDBCStoreManager.findEntities(Ljava.lang.reflect.Meth od;[Ljava.lang.Object;Lorg.jboss.ejb.EntityEnterpriseContext;Lorg.jboss.ejb.GenericEntityObject Factory;)Ljava.util.Collection;(JDBCStoreManager.java:598)
> at org.jboss.ejb.plugins.CMPPersistenceManager.findEntities(Ljava.lang.reflect.Method;[ Ljava.lang.Object;Lorg.jboss.ejb.EntityEnterpriseContext;Lorg.jboss.ejb.GenericEntityObjectFact ory;)Ljava.util.Collection;(CMPPersistenceManager.java:278)
> at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.findEntities(Ljava. lang.reflect.Method;[Ljava.lang.Object;Lorg.jboss.ejb.EntityEnterpriseContext;Lorg.jboss.ejb.Ge nericEntityObjectFactory;)Ljava.util.Collection;(CachedConnectionInterceptor.java:325)
> at org.jboss.ejb.EntityContainer.findLocal(Lorg.jboss.invocation.Invocation;)Ljava.lang .Object;(EntityContainer.java:609)
> at jrockit.reflect.NativeMethodInvoker.invoke0(Ljava.lang.Object;ILjava.lang.Object;[Lj ava.lang.Object;)Ljava.lang.Object;(Unknown Source)
> at jrockit.reflect.NativeMethodInvoker.invoke(Ljava.lang.Object;[Ljava.lang.Object;)Lja va.lang.Object;(Unknown Source)
> at jrockit.reflect.VirtualNativeMethodInvoker.invoke(Ljava.lang.Object;[Ljava.lang.Obje ct;)Ljava.lang.Object;(Unknown Source)
> at java.lang.reflect.Method.invoke(Ljava.lang.Object;[Ljava.lang.Object;I)Ljava.lang.Ob ject;(Unknown Source)
> at org.jboss.ejb.EntityContainer$ContainerInterceptor.invokeHome(Lorg.jboss.invocation. Invocation;)Ljava.lang.Object;(EntityContainer.java:1066)
> at org.jboss.ejb.plugins.AbstractInterceptor.invokeHome(Lorg.jboss.invocation.Invocatio n;)Ljava.lang.Object;(AbstractInterceptor.java:88)
> at org.jboss.ejb.plugins.EntitySynchronizationInterceptor.invokeHome(Lorg.jboss.invocat ion.Invocation;)Ljava.lang.Object;(EntitySynchronizationInterceptor.java:204)
> at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.invokeHome(Lorg.jbo ss.invocation.Invocation;)Ljava.lang.Object;(CachedConnectionInterceptor.java:215)
> at org.jboss.ejb.plugins.AbstractInterceptor.invokeHome(Lorg.jboss.invocation.Invocatio n;)Ljava.lang.Object;(AbstractInterceptor.java:88)
> at org.jboss.ejb.plugins.EntityInstanceInterceptor.invokeHome(Lorg.jboss.invocation.Inv ocation;)Ljava.lang.Object;(EntityInstanceInterceptor.java:97)
> at org.jboss.ejb.plugins.EntityLockInterceptor.invokeHome(Lorg.jboss.invocation.Invocat ion;)Ljava.lang.Object;(EntityLockInterceptor.java:61)
> at org.jboss.ejb.plugins.EntityCreationInterceptor.invokeHome(Lorg.jboss.invocation.Inv ocation;)Ljava.lang.Object;(EntityCreationInterceptor.java:28)
> at org.jboss.ejb.plugins.AbstractTxInterceptor.invokeNext(Lorg.jboss.invocation.Invocat ion;Z)Ljava.lang.Object;(AbstractTxInterceptor.java:88)
> at org.jboss.ejb.plugins.TxInterceptorCMT.runWithTransactions(Lorg.jboss.invocation.Inv ocation;)Ljava.lang.Object;(TxInterceptorCMT.java:317)
> at org.jboss.ejb.plugins.TxInterceptorCMT.invokeHome(Lorg.jboss.invocation.Invocation;) Ljava.lang.Object;(TxInterceptorCMT.java:130)
> Oracle not support left join syntax,how to configure jboss to use oracle-style left-join?
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
19 years, 8 months