RE: CGI Fact Finding Mission (Need Input)

["Stone, Brad V (TC)" <bvstone@xxxxxxxxxxxxxx>]

In a rare instance where checking is not performed, it could cause the job
to have a MSGW status.  But it would not crash your system.  Not to mention,
it would only stop (until someone fixed the problem) one instance that is
running, so others would still be able to surf your site.

I could see how ASP would be easy to "crash a system", but not with RPG.
First, you read the Standard input and or Query string input.  Then you
convert it to a DB.  That API will either error or complete or issue warning
messgages, so I'm not even sure one could force a server instance into MSGW
by sending bad data into the data stream.  If one was monitering the result
codes for the HTTP APIs, a simple message could be displayed.

Remember, the article you read no doubt deals with PCs.  Much easier to
hack/crash.  

Bradley V. Stone
BVS/Tools
http://www.bvstools.com




> -----Original Message-----
> From: Goodbar, Loyd (AFS-Water Valley) 
> [mailto:LGoodbar@afs.bwauto.com]
> Sent: Friday, November 19, 1999 11:07 AM
> To: 'MIDRANGE-L@midrange.com'
> Subject: RE: CGI Fact Finding Mission (Need Input)
> 
> 
> Why would it not crash your system? (Not flaming, just asking)
> 
> I guess it depends on the kind of datachecks that are done on 
> the server
> side. In _Hacking Exposed_, the authors address input 
> validation attacks on
> web pages. It could be possible to buffer overflow or 
> otherwise compromise
> the server CGI program to crash it or gain system access. 
> 
> The authors named ASP and generic *NIX (Perl/other CGI) CGI 
> programs. I
> don't know if (how) this might affect any server side 
> operations on the
> AS/400. The authors (like 99.44% others) ignore the AS/400.
> 
> The things I'm proposing looking at for datachecks are:
> * Length (not to exceed specified data length)
> * Type
> * Remove escape characters (*NIX uses "\" as a an escape 
> character, could
> cause the CGI program to inadvertently process code or 
> execute a command)
> * Bounds checking
> 
> This can take time if performed on all input variables, but 
> does go a long
> way toward "secure" or "defensive" programming. 
> 
> Any thoughts?
> Loyd
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---