[cobalt-developers] Dangerous security violation in Cobalt Developer Kit for Java

["Alexander Povargo" <apovargo@xxxxxxx>]

Hi,

it may be important to all who use Cobalt Developer Kit for Java.
tomcat.policy contains such permission for codeBase of virtual domains:
permission java.io.FilePermission "-", "read,write,delete";

Java runs as a root user, user.home property points to /
Given FilePermission allows to any servlet from any virtual host to have
full access to your file system with root privileges. All servlets can read,
write and delete any file on you system and possible crash you server.

Correct FilePermission must be given to codeBase of each domain:
permission java.io.FilePermission "/home/sites/{siteN}/-",
"read,write,delete"
where siteN - directory of your virtual site inside /home/sites: site1,
site2, etc.

Simple and quick solution: remove codes which generate tomcat.policy from
/usr/java/jakarta-tomcat/bin/cobalt_config.pl
Best solutions: rewrite cobalt_config.pl with more intelligent code.

Hope it may be helpful to all who use Cobalt's Tomcat.

Best regards,
Alex