Re: Re: Recent bugtraq postings

[Steve Richter <stephenrichter@xxxxxxxxx>]

On 4/25/05, Patrick Botz <pcbotz@xxxxxxxxx> wrote:
> These are my opinions only. They do not necessarily reflect the opinions of
> my employer...
> 
> Just a couple examples of inaccuracies
> 
> 
>    2. Claim: OS400 has a security exposure because a bad person could
>   use commands on OS400 to do bad things on Windows.
>   Implication: OS400 causes the exposure.
>   Clarification: The fact that you can use information from a connection
>   established by windows to perform windows commands unrelated to the
>   connection is not an exposure of another system that "COULD" take advantage
>   of it. It is a windows exposure. It's something that needs to be managed or
>   fixed in Windows.

what is unclear to me is if client access, an IBM software product, is
set by default to allow STRPCCMD to start a service like REXEC on a
PC.  If so, then that is a case of IBM software contributing to the
security exposure of a network.  is that correct?

Would still like to know if a PC user account, compared to super user
and administrator, can do any harm on a PC.

-Steve