RE: iSeries FTP security

[Patrick Botz <botz@xxxxxxxxxx>]

These are NOT vulnerabilities of FTP.  They are vulnerabilities that arise
from not managing object access control like you have to do on other
systems.  This is my point. All this talk of FTP and exit point programs
totally misses the real issue people need to deal with...object access
control is required in a network environment.

Patrick Botz
Senior Technical Staff Member
eServer Security Architect
(507) 253-0917, T/L 553-0917
email: botz@xxxxxxxxxx



                                                                           
             shalom@xxxxxxxxxx                                             
             Sent by:                                                      
             midrange-l-bounce                                          To 
             s@xxxxxxxxxxxx            midrange-l@xxxxxxxxxxxx             
                                                                        cc 
                                                                           
             05/18/2005 10:20                                      Subject 
             AM                        RE: iSeries FTP security            
                                                                           
                                                                           
             Please respond to                                             
             Midrange Systems                                              
                 Technical                                                 
                Discussion                                                 
                                                                           
                                                                           




Scott,
These are vulnerabilities of a particular implementation of FTP,
in a specific operating system - OS400.

The problem is not with the implementation of FTP, but with the false sense
of security we had when we installed an FTP exit program and thought that
it works in a specific way, when in fact it provides a loophole for
unplanned access.

The same applies to the iSeries implementation of LDAP.
A limited iSeries user cannot run WRKUSRPRF,
but the LDAP query provides full information about a group of local users,
including all of the profile attributes.

This feature is not found in other LDAP products.
Netscape LDAP does not disclose the list of local users that
are defined on the server it runs on.


I agree that the LDAP issue is not a major problem,
but it was never presented as such.

Regards,
Shalom Carmel
-------------
www.venera.com - Exposing iSeries insecurity



-----Original Message-----
Subject: RE: iSeries FTP security
From: "Ingvaldson, Scott" <SIngvaldson@xxxxxxxxxxxx>
Date: Tue, 17 May 2005 10:52:05 -0500

Shalom -

For simplicity I'll concede every one of your points.  Now please
explain to me why these are iSeries vulnerabilities rather than FTP or
LDAP vulnerabilities.

Regards,

Scott Ingvaldson
iSeries System Administrator
GuideOne Insurance Group


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.