From: <glassfish_at_javadesktop.org>
Date: Fri, 09 May 2008 00:40:01 PDT
A simple solution, IMO, is to have an option on the pool or JDBC resource that disallows remote access to the definition.
I wrote a short article on my site about how to mitiigate this problem until a real solution is available: