Re: iSeries FTP security

Regardless of anyone's motives, canonicalization is a well published
script kiddie, junior hacker kind of attack, not only for ftp but for
many other server programs on other systems (just google 'canonicalization
exploit' and see a list. I, for one, am happy to see most of the exit
pgm vendors did a fix. We need to get it into our heads, that universal
programs like ftp, smtp, telnet, http, sql, etc have been recognized as
having
some vulnerability for years. To ignore that fact, chanting "the iSeries is
the
most secure server" is to stick your head in the sand. If you haven't read
IBM's Tips & Tools for Securing Your iSeries
http://publib.boulder.ibm.com/infocenter/iseries/v5r3/ic2924/books/sc415300.pdf
to even be aware of the complexity of saying "your secure", then dream on.
Pat Botz is right that a high level of security comes thru controlling
authorizations, but for the
majority of us working in either homegrown or packaged software not
built that way, it is good to know what's going on in the hacker world. And
now i have to go fix my ftp exit pgm....
jim

----- Original Message ----- 
From: "Ingvaldson, Scott" <SIngvaldson@xxxxxxxxxxxx>
To: <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, May 17, 2005 9:33 AM
Subject: RE: iSeries FTP security


> Of course that would be a serious vulnerability.  But who among us does
> not already know this and should it really be considered an "exploit?"
> As to the second question, you don't need to write a program to secure
> FTP, you can just turn it off.
>
> The disservice that Mr. Carmel is doing is not in the area of educating
> users on iSeries security, it is in the misposting of these
> "vulnerabilities" in places like Bugtraq and suggesting that these are
> weaknesses inherent in the iSeries.  Maybe I'm off base here, but in my
> mind a true exploit reads something like this: "Attackers can exploit a
> buffer overflow in the login to gain root access..."
>
> Certainly we can all pay more attention to security and most likely
> every one of us has multiple back doors and unauthorized access points
> on our systems that could be locked down a little tighter.  Should
> something like this really be considered a serious vulnerability: "A
> valid, authenticated user can access and retrieve all of the files that
> he has authority to..."  Or is that how it's supposed to work?
>
> Should someone post to Bugtraq the fact that many newer iSeries models
> have a port in the back that accepts a standard ethernet cable and will
> allow any "valid, authenticated user" to download all of "the files that
> he has authority to?"  If you unplug your ethernet lines your system
> will be much more secure (and much more useless.)
>
> Regards,
>
> Scott Ingvaldson
> iSeries System Administrator
> GuideOne Insurance Group
>
>
>
> -----Original Message-----
> date: Mon, 16 May 2005 15:38:01 -0600 (MDT)
> from: James Rich <james@xxxxxxxxxxx>
> subject: RE: iSeries FTP security
>
> On Mon, 16 May 2005, Ingvaldson, Scott wrote:
>
> > I'll certainly agree that many, if not most, shops do not pay enough
> > attention to security.  What I disagree with is that this particular
> > "exploit" is as serious as is implied, based on the requirement of a
> > valid, authenticated user to perform it.  That's like saying that
> > leaving your QSECOFR password set to default and having a direct
> > internet connection is a "serious vulnerability."
>
> Doing so *does* constitute a serious vulnerability.
>
> > Certainly, Rob, a sufficiently knowledgeable and talented user could
> use
> > FTP to go after
> >
> /qsys.lib/mylib.lib/myfile.file/mymbr.mbr/../../payroll.file/payroll.mbr
> > and download the payroll file, but should this user have FTP access to
> > this system at all?  Is this really an "exploit" or, to coin a phrase
> > "Working As Designed?"  How difficult is it to write an Exit Point
> > Program to restrict all FTP access to authorized FTP users only?
>
> So to adequately secure an iSeries I have to write a program?
>
> Exploits can take advantage of coding flaws, configuration flaws, and
> design flaws.  That something is working as designed does not in and of
> itself mean that it not an exploit.  Look no further than ActiveX for
> proof of that.
>
>
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>