RE: iSeries buffer overflow immunity?

[Chris Bipes <chris.bipes@xxxxxxxxxxxxxxx>]

The difference in this particular vulnerability is how the OS handles the
error condition.  OS400 puts up a CPF message and stops the programming from
processing.  Windows returns to a command line.  Don't know about other
OS's.

Chris Bipes 

-----Original Message-----

Is the iseries invulnerable to buffer overflows?  I was doing a bit of
googling, and it seems there is a general impression from individual
users that things are OK, but I don't see such information from large
companies or vendors.

I routinely make calls from ILE RPG into the C runtime library, in what
I believe are 'safe' calls.  We have more and more C code converted to
run on the iSeries, such as the Apache HTTP server.

As buffer overflows have been found in things like Apache, it stands to
reason that the iSeries version would have been compiled from the same
source code, and thus have the same coding error.  But, can the coding
error be exploited?  Denial of service?  Privilege escalation?

I'm not aware of any systems that have been compromised in any way, but
I'd like to find some assurances about that.