Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0000418Openbravo ERPK. Packagingpublic2008-05-23 15:522009-03-18 11:02
Reporteralostale 
Assigned Tojpabloae 
PrioritynormalSeveritymajorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0000418: Openbravo database schema has dba privileges
DescriptionThe Openbravo installation grants to the Oracle user housing the Openbravo schema (TAD by default) DBA privileges.

This is a security vulnerability because if hackers manage to get access to this user, they will gain control of the full database.

This is a particularly serious concern for those customers who deploy Openbravo in an Oracle database that houses other applications as well.
Steps To ReproduceConnect to Oracle and verify privileges.
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
related to defect 00001242.40 closed alostale Openbravo database schame has dba privileges 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2008-05-23 15:52alostaleNew Issue
2008-05-23 15:52alostaleAssigned To => alostale
2008-05-23 15:52alostaleIssue generated from0000124
2008-05-23 15:52alostaleRelationship addedrelated to 0000124
2008-05-23 15:55alostaleNote Added: 0000322
2008-05-23 15:56alostaleProjectOpenbravo ERP => @5@
2008-05-23 16:02alostaleAssigned Toalostale => jpabloae
2008-05-23 17:49jpabloaeStatusnew => acknowledged
2008-05-23 17:49jpabloaeversion2.35 =>
2008-05-23 17:49jpabloaeSummaryOpenbravo database schame has dba privileges => Openbravo database schema has dba privileges
2008-05-23 18:16alostaleIssue Monitored: alostale
2008-06-12 01:50jpabloaeCategoryC. Security => Installer
2008-06-19 17:47svnbotCheckin
2008-06-19 17:47svnbotNote Added: 0007878
2008-06-19 17:47svnbotStatusacknowledged => resolved
2008-06-19 17:47svnbotResolutionopen => fixed
2008-06-19 17:47svnbotsvn_revision => 61
2008-11-13 07:02jpabloaeStatusresolved => closed
2008-11-25 21:41pjuvaraSticky IssueNo => Yes
2008-11-25 21:43pjuvaraProject@5@ => Openbravo ERP
2008-11-25 21:45pjuvaraCategoryInstaller => K. Packaging
2008-11-25 21:47pjuvaraSticky IssueYes => No
2009-03-18 11:02anonymoussf_bug_id0 => 2691312

Notes
(0000322)
alostale   
2008-05-23 15:55   
The installer should create the user with the same privileges creation from files does.

Currently:
        grant create session to ${bbdd.user};
          grant alter session to ${bbdd.user};
          grant create table to ${bbdd.user};
          grant create procedure to ${bbdd.user};
          grant create trigger to ${bbdd.user};
          grant create view to ${bbdd.user};
          alter user ${bbdd.user} quota unlimited on users;
(0007878)
svnbot   
2008-06-19 17:47   
Repository: packaging
Revision: 61
Author: jpabloae
Date: 2008-06-19 17:47:42 +0200 (Thu, 19 Jun 2008)

Fixes issue 418: Openbravo database schema has dba privileges . Fixes issue 4035: out of cursors

---
U installer/trunk/demodata.patch
U installer/trunk/openbravo-only.xml
---

https://dev.openbravo.com/websvn/packaging/?rev=61&sc=1 [^]