RE: Re: Recent bugtraq postings

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

Hello,

> The thing to remember is that the command run by STRPCCMD runs under the 
> same user profile as the user currently signed on to the PC.
>
> So anything sent by STRPCCMD can't do any more damage than the user 
> could be doing a "Start"-->"Run".  If the user should be able to start a 
> REXEC client, then they shouldn't be allowed to start a REXEC client 
> using any means.

I think the assertion being made here is that commands can be run on their 
PC without the user's knowledge.

Just for the sake of seeing this from another angle...  think about other 
TCP/IP applications: If you pointed your web browser at a site on the 
Internet, say for example you went to http://www.scottklement.com for some 
reason, it would be a really bad thing if I could program my server to 
execute commands on your PC. Even if it's with your authority!  I could 
submit a background job on your PC that you wouldn't even know is running 
that, for example, sends me all of the e-mail addresses in your system.  I 
could then sell them to spammers!

Is 5250 really different from that?  If you connect to, say, a timeshare 
service on the Internet with Client Access, and without your knowledge, 
that service was able to run programs on your PC, wouldn't that be a 
problem?  It could start a background job that FTPs all of your Word 
documents to a 3rd party site, without your knowledge!  If you had 
anything private, it just got stolen.

However, the bugtraq posting isn't accurate, either.  First of all this 
isn't a vulnerability in the iSeries. It doesn't compromise the iSeries at 
all, only your PC. It's the PC software that's insecure, not the iSeries. 
Secondly, it's not true of all emulation software (despite the claim to 
the contrary!)

Really, you should never use CA to connect to any site where you don't 
completely trust all of the code on the machine. And with a 5250 client, 
that's often possible. But, it doesn't hurt to make people aware of it.