Re: iSeries buffer overflow immunity?

On Wed, 2004-11-03 at 19:02, Scott Klement wrote:

> Anyway -- getting back to the original question "is the iSeries
> invulnerable to buffer overflows?". No. You can overflow a buffer,
> causing other variables in the job to be wrong.  This might be used to
> cause a web server to crash, or something like that.
> 
> But, you can't change a running program, which really limits what you can
> do.  And you run the risk of hitting memory that you don't have permission
> to, which will cause the program to crash.
> 
> About the best you can do is a denial of service attack.
This is the reasoning I've been using.  In the case of Apache (I'm
picking on it a lot because it's a big target), a bug that allows root
compromise via a buffer overflow exploit on windows or linux *may* allow
a denial of service on iSeries, but no more.  

The main reason (if I understand correctly) that it cannot be a root
compromise is because overwriting variables is not a feasible way to
change executable code, the stack, or the instruction pointer.  Right?

The main reason it could be a denial of service is that by writing too
much data to the buffer, our overflow could cause the job to crash with
an MCHxxxx error because we are trying to access storage we don't own or
aren't authorized to.  Right?

>You can overflow a buffer,
> causing other variables in the job to be wrong.

Hmm.  I'd like to explore this point a bit further.  'variables ...
wrong'  Or set to values of my will and pleasure?  Imagine I have a
service where an unprotected buffer is immediately (or even just
somewhat closely) followed in storage by a 'privileged user' flag. 
Overflow the buffer and set the privileged user flag!  If done properly,
attacker has some type of unauthorized access to the system.  No,
probably not a command line, but perhaps enough to get into the admin
area of your application.

> 
> The design of the iSeries is really an incredible thing.  It's just one of
> the best designed systems out there!  Unfortunately, very few people
> understand and appreciate this...
I've been appreciating it since 1985 (S/38), 1988 (AS/400).  Somewhere
around here I've still got the microfiche source code to CPF written in
PL/MI...

--
Regards,
Rich

Current Conditions in Des Moines, IA
Overcast
Temp 46.4F
Winds out of the East at 7mph