RE: security hole in interactive sql call statement?

John,

I see you your point.  I was probably trying to be to simplistic.

Charles Wilt
iSeries Systems Administrator / Developer
Mitsubishi Electric Automotive America
ph: 513-573-4343
fax: 513-398-1121
 

> -----Original Message-----
> From: John Earl [mailto:john.earl@xxxxxxxxxxxxx]
> Sent: Tuesday, November 16, 2004 5:44 PM
> To: Midrange Systems Technical Discussion
> Subject: RE: security hole in interactive sql call statement?
> 
> 
> > Consider STRSQL as the RDBMS equivalent to the command
> > line.
> > 
> > Thus, if you don't allow the programmers access to the
> > command line you
> > probably shouldn't be allowing access to STRSQL either.
> 
> I think I want to disagree with that thought Charles - In the example
> presented the database was secure against programmer access (so STRSQL
> was no additional threat), it's just that other portions of 
> the OS were
> not secured well enough to prevent identity theft of the production
> owning User Profile.  That may be a common security exposure but it's
> not one that you can lay at the feet of the STRSQL statement, or even
> the RDBMS.
> 
> JMHO,
> 
> jte  
>