Re: QPJOBLOG security

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

We have a winner!

An OVRPRTF statement could be used to HOLD the printfiles.  The when the DBU or
UPDDTA command was issued, the OUTQ would never generate a data queue entry
because the spool file never got to a RDY status.

jte

"M. Lazarus" wrote:

> John,
>
> At 11/2/00 01:19 PM -0800, you wrote:
> >P.S.  For you security sleuths out there: there is at least one potential
> >security flaw in this design that made us unable to gauranty that no one
> >deleted
> >their own spool files.  Can you find it?
>
>   The user can hold or delete the spool before it ever hits ready
> status.  How'd I do?
>
>   -mark
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

--
John Earl                    johnearl@400security.com
The PowerTech Group      --> new number --> 253-872-7788
PowerLock Network Security   www.400security.com
--




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---