RE: Research Project- Sources Outside the AS/400 & How these affe ct security

["DeLong, Eric" <EDeLong@xxxxxxxxxxxxxxx>]

Nathan,

I have to say I had doubts about this too, but Google turns up quite a few
articles that explain the problem..
http://www.sitepoint.com/article/794/2


Eric DeLong
Sally Beauty Company
MIS-Project Manager (BSG)
940-898-7863 or ext. 1863



-----Original Message-----
From: Nathan M. Andelin [mailto:nandel@xxxxxxxxxxxxxxxxxxx]
Sent: Friday, January 30, 2004 4:13 PM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: Research Project- Sources Outside the AS/400 & How these
affect security


> Websites hosted on OS/400 are vulnerable to the
> same exploits used against other web servers.
> "SQL injection" is a good example; relying on user
> code constructing a dynamic website not operating
> system flaws. 
> The idea is to stick executable statements into
> variables which will be used to construct webpages
> and thereby run them with the authority of the web
> server.

Where do tales like this originate?  Sending an SQL statement to an OS/400
Web Server in a variable and having it run sounds nearly absurd to me.  The
Web server itself definitely won't run it.

Someone having Telnet or FTP access and enough authority to install programs
on the server could write a CGI program or Servlet to fetch form variables
and pass them to an SQL processor, but how realistic is that?

Even if such a service were in place, any SQL running under the Web server
user profile would have access to just about nothing, so the CGI program or
Servlet would need to connect to the SQL processor with a more powerful user
profile to pack any punch.

I hope you'll become more informed about OS/400 Web services.

Nathan.



_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.