RE: Recent bugtraq postings

["John Earl" <john.earl@xxxxxxxxxxxxx>]

> if you don't
> have Godlike authorities and you try the LDAP "exploit",
> do you still
> get a list of all users?

If you are authorized to read (*USE) a user profile, or you belong to
the same group profile as another user, then the LDAP directory will
display the user name to you.  

But... if you have *USE rights to someone's user profile (whether
because of *ALLOBJ, or Group rights, or whatever), then there are any
number of methods by which you can see the user profile (DSPOBJD,
WRKUSRPRF, IFS links, etc.), so I don't see how this is an "LDAP"
problem.  

And if you have the ability to *USE a profile, you also have the ability
to assume the identity of that profile - which is potentially a HUGE
security problem, but it's a "security configuration" problem and not a
failing of the underlying facilities.

IMHO,

jte


--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl@xxxxxxxxxxxxx
www.powertech.com 
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
> bounces@xxxxxxxxxxxx] On Behalf Of Joe Pluta
> Sent: Friday, April 22, 2005 9:00 AM
> To: 'Midrange Systems Technical Discussion'
> Subject: RE: Recent bugtraq postings
> 
> True (although the older I've gotten the more reticent I
> am to accept
> such authority -- it's plausible deniability <grin>).  But
> if you don't
> have Godlike authorities and you try the LDAP "exploit",
> do you still
> get a list of all users?
> 
> Joe
> 
> > From: rob@xxxxxxxxx
> >
> > Joe, you and I probably have Godlike authority on most
> of the machines
> we
> > work on.  Normal users execution of WRKUSRPRF tells them
> nasty things
> > about their mother.  Their workaround is to do a WRKOBJ
> QUSRSYS/*ALL
> > *MSGQ.
> 
> --
> This is the Midrange Systems Technical Discussion
> (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/midrange-l.