RE: Re: Recent bugtraq postings -- MIDRANGE-L

Hello,

The thing to remember is that the command run by STRPCCMD runs under the same user profile as the user currently signed on to the PC.

So anything sent by STRPCCMD can't do any more damage than the user could be doing a "Start"-->"Run". If the user should be able to start a REXEC client, then they shouldn't be allowed to start a REXEC client using any means.

I think the assertion being made here is that commands can be run on their PC without the user's knowledge.

Just for the sake of seeing this from another angle... think about other TCP/IP applications: If you pointed your web browser at a site on the Internet, say for example you went to http://www.scottklement.com for some reason, it would be a really bad thing if I could program my server to execute commands on your PC. Even if it's with your authority! I could submit a background job on your PC that you wouldn't even know is running that, for example, sends me all of the e-mail addresses in your system. I could then sell them to spammers!

Is 5250 really different from that? If you connect to, say, a timeshare service on the Internet with Client Access, and without your knowledge, that service was able to run programs on your PC, wouldn't that be a problem? It could start a background job that FTPs all of your Word documents to a 3rd party site, without your knowledge! If you had anything private, it just got stolen.

However, the bugtraq posting isn't accurate, either. First of all this isn't a vulnerability in the iSeries. It doesn't compromise the iSeries at all, only your PC. It's the PC software that's insecure, not the iSeries. Secondly, it's not true of all emulation software (despite the claim to the contrary!)

Really, you should never use CA to connect to any site where you don't completely trust all of the code on the machine. And with a 5250 client, that's often possible. But, it doesn't hurt to make people aware of it.

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.