Another security exposure

(sorry if this is a dup - I probably used the wrong list address earlier)

With all this recent talk of security flaws, I am reminded of the old 
workstation message queue flaw.

I'm pretty sure it worked on the S/38, I know it's worked on AS/400 at least up 
to V2R3.  I haven't tried it in years, but it probably still works.  I'm on the 
road this week, so I'll have to see if I can dig up the source this weekend.

Anyone with the capability to write a trivial MI program can inject program 
calls to the workstation of any other signed on user, including QSECOFR.  I'm 
not clear on whether this can be  implemented in ILE, however - hopefully one 
of the list experts will know.

The AS/400 CHGMSGQ command allows you to specify a program to call when a 
message arrives at your workstation, rather than the default break message 
window.  The IBM version of the command won't allow you to change anothers work 
station, but it's quite simple to write one that ignores this restriction, as 
the parameters are stored in the workstation message queue associated space.  

Whenever a break message arrives, the OS consults the workstation message queue 
object to decide what to do.  So, if you can arrange to change the associated 
space of anothers message queue, you can change anothers work station to call a 
program of your choosing when a message arrives.  Since any commands then 
emanate from their workstation, all of their authority will be used in 
execution, as though they typed it on the keyboard and pressed enter.

Now, as far as what to do with it, I'm guessing that security level 50 makes it 
much harder to do.  I suppose the proper OS fix would be to ensure that job A 
is locked out of directly modifying message queue attributes of job B, or 
perhaps that the current state of the message queue is stored in memory, and 
the message queue object is not referred to each time a message arrives.

Regards,
Rich

        

+---
| This is the MI Programmers Mailing List!
| To submit a new message, send your mail to MI400@midrange.com.
| To subscribe to this list send email to MI400-SUB@midrange.com.
| To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: dr2@cssas400.com
+---