RE: Re: Recent bugtraq postings

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx]On Behalf Of Scott Klement
> Sent: Monday, April 25, 2005 3:06 PM
> To: Midrange Systems Technical Discussion
> Subject: RE: Re: Recent bugtraq postings
> 
> 
> Hello,
> 
> > The thing to remember is that the command run by STRPCCMD 
> runs under the 
> > same user profile as the user currently signed on to the PC.
> >
> > So anything sent by STRPCCMD can't do any more damage than the user 
> > could be doing a "Start"-->"Run".  If the user should be 
> able to start a 
> > REXEC client, then they shouldn't be allowed to start a 
> REXEC client 
> > using any means.
> 
> I think the assertion being made here is that commands can be 
> run on their 
> PC without the user's knowledge.

Good point, though I don't know of anyway to prevent the command prompt window 
from flashing on the PC.

So you couldn't have a command run completely unnoticeable.


> 
> Just for the sake of seeing this from another angle...  think 
> about other 
> TCP/IP applications: If you pointed your web browser at a site on the 
> Internet, say for example you went to 
> http://www.scottklement.com for some 
> reason, it would be a really bad thing if I could program my 
> server to 
> execute commands on your PC. Even if it's with your 
> authority!  I could 
> submit a background job on your PC that you wouldn't even 
> know is running 
> that, for example, sends me all of the e-mail addresses in 
> your system.  I 
> could then sell them to spammers!
> 
> Is 5250 really different from that?  If you connect to, say, 
> a timeshare 
> service on the Internet with Client Access, and without your 
> knowledge, 
> that service was able to run programs on your PC, wouldn't that be a 
> problem?  It could start a background job that FTPs all of your Word 
> documents to a 3rd party site, without your knowledge!  If you had 
> anything private, it just got stolen.

Good examples.

> 
> However, the bugtraq posting isn't accurate, either.  First 
> of all this 
> isn't a vulnerability in the iSeries. It doesn't compromise 
> the iSeries at 
> all, only your PC. It's the PC software that's insecure, not 
> the iSeries. 
> Secondly, it's not true of all emulation software (despite 
> the claim to 
> the contrary!)

Exactly.  Apparently Shalom thinks CA is the iSeries and vice versa.  The fact 
that the iSeries can send the command is not the problem.  The problem is the 
PC software runs it automatically.  AFAIK, CA doesn't offer a method to turn 
this off.

In a corporate environment, I don't consider this a problem.  But for a 
consultant, I can see where it could be.

> 
> Really, you should never use CA to connect to any site where 
> you don't 
> completely trust all of the code on the machine. And with a 
> 5250 client, 
> that's often possible. But, it doesn't hurt to make people 
> aware of it.
> 

Don't know how many iSeries sites I'd consider "untrustworthy".  But I do see 
your point.


Charles