RE: security hole in interactive sql call statement?

> if I set the user profile to LMTCPB(*YES), the profile should not be able
to access any limited command from any ibm tool.

The limit capabilities option only works for function that goes through the
command analyzer. The SQL CALL command in STRSQL is not a CL command.

If you do have object authority in place on the programs that a developer
might call from the SQL CALL command in STRSQL, I think they would be
prevented from calling that program. In addition, if the called program
attempts to manipulate data that the programmer is not authorized to, the
program will not complete successfully (assuming that the program doesn't
adopt authority).

My point in all of this, is that relying on LMTCPB(*YES) as your only
access control mechanism for data or programs provides very little
security.

Patrick Botz