RE: BugTraq Exploit for OS/400

["Sean Porterfield" <sporter@xxxxxxxxxxxx>]

>-----Original Message-----
>From: Jim Franz

> Well, the rest of the world sees the listing of all the user
> accounts on a system as a bug! And this ain't the only one.

I tend to disagree with that.  Since when is the passwd file on a Un*x type
system not public readable?  Anyone with a valid logon can just `cat
/etc/passwd` and get a list of all the users.  Linux and others use shadow
passwords so that same attacker can't compare passwords off system (and is
forced to attempt brute force attacks against the system) but the passwd
file has to be readable.

Although, I still agree that this is a vulnerability....  Because if a user
is not set to LMTCPB(*YES) and they do WRKUSRPRF *ALL they only see users
that they have sufficient authority to see.  But in the DSPJOB OPTION(*LIBL)
follwed by 5 on QSYS, they see all users, but can only display the object
description if they are authorized.  (Same goes if they use WRKOBJ QSYS/*ALL
*USRPRF  -- the user profile doesn't even show up if the user is not
authorized to it.)