Re: OS/400 User Account Name Disclosure Vulnerability

At 11:13 AM 3/5/02 -0600, you wrote:

>On Mon, 4 Mar 2002, Vernon Hamberg wrote:
> >
> > Properly administered, it would be extremely difficult to
> > hack it. It's almost impossible to put a worm or virus or similar item
> on it.
> >
>
>I'm sorry, but this statement is simply wrong.  Writing a worm that runs
>on OS/400 is VERY easy.   All you have to do is scan for *CMD objects
>that you have authority to change, and insert yourself as the CPP for
>those commands.   Then, once your code has been executed, simply call
>the original CPP, and nobody ever knows.

Yeah, that's right. And those methods have been known and documented in
places like the Tips and Tools book for years.

I guess my point has to do with external attacks. An ostrich attitude is
definitely not the way to go.

But the vulnerability that started all this good discussion is, IMO, almost
a non-issue. The person who wanted to do damage this way is already far
into unauthorized territory when they've got on the machine in the first place.

Is the benefit of shutting this down worth the cost? Is it worth the
limitations on valid use, as well as human effort? Maybe so. You makes your
own call here.  :-)