RE: BugTraq Exploit for OS/400

["Hall, Philip" <phall@xxxxxxxx>]

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
--
[ Picked text/plain from multipart/alternative ]
Dan,

> To most IBM midrangers, this would be considered status
> quo.  Maybe I just find it strange that this is news.

It's not 'news' the BugTraq posting is very lame, and if that's the best
they can post for OS/400, then thank IBM that that's the case.

> After all, doesn't every AS/400 have a QSECOFR (and
> other IBM-supplied) profiles?

Yes, just like Unix has root - but often you don't want to use QSECOFR (or
can't if sign-on is limited to specific devices) to maintain a low profile.

> In consideration of the userID=password scenario, the
> vulnerability is the
> person(s) managing the system, IMO.

Yes, but 20-20 hindsight won't fix what damage has been done by Mr. Hacker
using that iser profile & password ;-)

--phil