RE: iSeries FTP security -- MIDRANGE-L

Of course that would be a serious vulnerability.  But who among us does
not already know this and should it really be considered an "exploit?"
As to the second question, you don't need to write a program to secure
FTP, you can just turn it off.

The disservice that Mr. Carmel is doing is not in the area of educating
users on iSeries security, it is in the misposting of these
"vulnerabilities" in places like Bugtraq and suggesting that these are
weaknesses inherent in the iSeries.  Maybe I'm off base here, but in my
mind a true exploit reads something like this: "Attackers can exploit a
buffer overflow in the login to gain root access..."  

Certainly we can all pay more attention to security and most likely
every one of us has multiple back doors and unauthorized access points
on our systems that could be locked down a little tighter.  Should
something like this really be considered a serious vulnerability: "A
valid, authenticated user can access and retrieve all of the files that
he has authority to..."  Or is that how it's supposed to work?  

Should someone post to Bugtraq the fact that many newer iSeries models
have a port in the back that accepts a standard ethernet cable and will
allow any "valid, authenticated user" to download all of "the files that
he has authority to?"  If you unplug your ethernet lines your system
will be much more secure (and much more useless.)

Regards,
 
Scott Ingvaldson
iSeries System Administrator
GuideOne Insurance Group



-----Original Message-----
date: Mon, 16 May 2005 15:38:01 -0600 (MDT)
from: James Rich <james@xxxxxxxxxxx>
subject: RE: iSeries FTP security

On Mon, 16 May 2005, Ingvaldson, Scott wrote:

> I'll certainly agree that many, if not most, shops do not pay enough
> attention to security.  What I disagree with is that this particular
> "exploit" is as serious as is implied, based on the requirement of a
> valid, authenticated user to perform it.  That's like saying that
> leaving your QSECOFR password set to default and having a direct
> internet connection is a "serious vulnerability."

Doing so *does* constitute a serious vulnerability.

> Certainly, Rob, a sufficiently knowledgeable and talented user could
use
> FTP to go after
>
/qsys.lib/mylib.lib/myfile.file/mymbr.mbr/../../payroll.file/payroll.mbr
> and download the payroll file, but should this user have FTP access to
> this system at all?  Is this really an "exploit" or, to coin a phrase
> "Working As Designed?"  How difficult is it to write an Exit Point
> Program to restrict all FTP access to authorized FTP users only?

So to adequately secure an iSeries I have to write a program?

Exploits can take advantage of coding flaws, configuration flaws, and 
design flaws.  That something is working as designed does not in and of 
itself mean that it not an exploit.  Look no further than ActiveX for 
proof of that.