Re: iSeries buffer overflow immunity?

Programmers can create buffer overflow conditions on the iSeries just
as on any other system.  The difference is that the iSeries will not
allow a program to change memory not allocated to the job, and the
iSeries will not present drop in to the command shell when a program
crashes.

In other words, the program will still crash, but nothing nasty can be
done after the crash happens.  The iSeries can have buffer overflows,
but is immune from the nastiness that a can occur when a buffer
overflow is generated.

Make sense?

On Wed, 03 Nov 2004 15:58:22 -0600, Rich Duzenbury
<rduz-midrange@xxxxxxxxxxxxxxxxxxx> wrote:
> Is the iseries invulnerable to buffer overflows?  I was doing a bit of
> googling, and it seems there is a general impression from individual
> users that things are OK, but I don't see such information from large
> companies or vendors.
> 
> I routinely make calls from ILE RPG into the C runtime library, in what
> I believe are 'safe' calls.  We have more and more C code converted to
> run on the iSeries, such as the Apache HTTP server.
> 
> As buffer overflows have been found in things like Apache, it stands to
> reason that the iSeries version would have been compiled from the same
> source code, and thus have the same coding error.  But, can the coding
> error be exploited?  Denial of service?  Privilege escalation?
> 
> I'm not aware of any systems that have been compromised in any way, but
> I'd like to find some assurances about that.
> 
> Thanks.
> 
> --
> Regards,
> Rich
> 
> Current Conditions in Des Moines, IA
> Broken Clouds
> Temp 46.4F
> Winds out of the Northeast at 3mph
> 
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
> 
> 


-- 
Tom Jedrzejewicz
tomjedrz@xxxxxxxxx