Not logged in : Login

About: VirtDefaultSPARQLEndpointSPARULVulnerability     Goto   Sponge   NotDistinct   Permalink

An Entity of Type : atom:Entry, within Data Space : ods.openlinksw.com associated with source document(s)

AttributesValues
type
Date Created
Date Modified
label
  • VirtDefaultSPARQLEndpointSPARULVulnerability
maker
Title
  • VirtDefaultSPARQLEndpointSPARULVulnerability
isDescribedUsing
has creator
content
  • %META:TOPICPARENT{name="VOSIndex"}% ---++ Virtuoso Default SPARQL 1.1 related Endpoint Vulnerability A vulnerability scenario has been discovered in the default <code>/sparql</code> endpoint of prior Virtuoso 7.2 releases, whereby despite defaulting to read-only access (using coarse-grained SQL ROLE based Security) certain SPARQL 1.1 INSERT & DELETE operations are possible, contrary to the perception relayed by the following error message: <verbatim> Virtuoso 42000 Error SR186:SECURITY: No permission to execute procedure DB.DBA.SPARQL_DELETE_DICT_CONTENT with user ID {some-user-id}, group ID {some-sql-role-account-id}. </verbatim> This issue has been resolved in the latest 7.2.4+ (3217+) build releases and available from the [[http://virtuoso.openlinksw.com/download/][Virtuoso Download]] page. For those running earlier releases the following SQL commands immediately secure existing instances, courtesy of Virtuoso's finer-grained Graph Security layer: <verbatim> DB.DBA.RDF_DEFAULT_USER_PERMS_SET ('nobody', 0, 1); -- nobody has no access to private named graphs DB.DBA.RDF_DEFAULT_USER_PERMS_SET ('nobody', 1, 0); -- 'nobody' can only read public named graphs </verbatim> Note this workaround has performance impact and can be disabled following upgrade to the new 7.2.4+ (3217+) binary. If you simply want to secure a specific named graph, you can issue the following: <verbatim> DB.DBA.RDF_GRAPH_GROUP_INS ('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','{named-graph-iri}') ; </verbatim>
id
  • a0cf309dfb71d991dab6244d54dae995
link
has container
http://rdfs.org/si...ices#has_services
atom:title
  • VirtDefaultSPARQLEndpointSPARULVulnerability
links to
atom:source
atom:author
atom:published
  • 2017-06-13T06:01:50Z
atom:updated
  • 2017-06-13T06:01:50Z
topic
is made of
is container of of
is link of
is http://rdfs.org/si...vices#services_of of
is creator of of
is atom:entry of
is atom:contains of
Faceted Search & Find service v1.17_git150 as of Jan 20 2025


Alternative Linked Data Documents: iSPARQL | ODE     Content Formats:   [cxml] [csv]     RDF   [text] [turtle] [ld+json] [rdf+json] [rdf+xml]     ODATA   [atom+xml] [odata+json]     Microdata   [microdata+json] [html]    About   
This material is Open Knowledge   W3C Semantic Web Technology [RDF Data] Valid XHTML + RDFa
OpenLink Virtuoso version 08.03.3332 as of Sep 11 2024, on Linux (x86_64-generic-linux-glibc25), Single-Server Edition (15 GB total memory, 704 MB memory in use)
Data on this page belongs to its respective rights holders.
Virtuoso Faceted Browser Copyright © 2009-2025 OpenLink Software