|
>-----Original Message----- >From: Jim Franz > Well, the rest of the world sees the listing of all the user > accounts on a system as a bug! And this ain't the only one. I tend to disagree with that. Since when is the passwd file on a Un*x type system not public readable? Anyone with a valid logon can just `cat /etc/passwd` and get a list of all the users. Linux and others use shadow passwords so that same attacker can't compare passwords off system (and is forced to attempt brute force attacks against the system) but the passwd file has to be readable. Although, I still agree that this is a vulnerability.... Because if a user is not set to LMTCPB(*YES) and they do WRKUSRPRF *ALL they only see users that they have sufficient authority to see. But in the DSPJOB OPTION(*LIBL) follwed by 5 on QSYS, they see all users, but can only display the object description if they are authorized. (Same goes if they use WRKOBJ QSYS/*ALL *USRPRF -- the user profile doesn't even show up if the user is not authorized to it.)
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
