Re: Recent bugtraq postings

["Shalom Carmel" <shalom@xxxxxxxxxx>]

About STRPCCMD:
CA is not the only emulation that supports this command.
There are at least 3 more emulations by different vendors that can be used
in a similar manner: Bosanova, PowerTerm, and Mochasoft.
Because the issue seems to be a generic iSeries 5250 emulation feature, and
because it works only in conjecture with an iSeries server,
in my opinion it is an iSeries issue, even though it affects the iSeries
client and not the server.

I've checked the capabilities of a user account in windows XP. The good news
are that no software can be installed by a user account.
The bad news are that some malware programs do not need installing, but only
execution rights.

Of course, letting users run their PCs with local administrative rights is a
common enough practice in the corporate world (it reduces helpdesk calls).

The screen flicker can be almost completely eliminated if the PC has the CA
rexec service installed.
The following command will start the rexec service in a promiscous mode:

strpccmd pccmd('sc start Cwbrxd /nosecok') pause(*no)

Now remote commands can be sent to the PC via the rexec service, and without
having to authenticate to the PC.



Shalom Carmel
----------------
www.venera.com - Exposing iSeries insecurity