iSeries Access PC5250 Vulnerability - STRPCCMD (Updated info)

["Wilt, Charles" <CWilt@xxxxxxxxxxxx>]

All,

You may remember a discussion a couple of months back concerning a possible 
vulnerability in iSeries Access from the STRPCCMD.

While this is a non-issue for most users who are accessing a trusted iSeries.  
There are those out there who access (relatively) non-trusted system form whom 
this could be an issue.

I created a DCR asking for a way to turn off the acceptance of a STRPCCMD.  
Just got the following response from IBM:

IBM has responded to your Design Change Request as follows: 

User Group Number - MR042705619
Document Status - Accepted
Title - Fix iSeries Access PC5250 Vulnerability

IBM agrees with the request and  a solution appears to be desirable and 
feasible. IBM intends to provide a solution. However IBM's plans may change and 
no commitment is made that a solution will be provided.

A function will be added via a V5R2 and V5R3 PTF of iSeries Access for 
Windows.to allow a user to specify in a workstion profile (.WS file) whether or 
not STRPCCMD will be allowed to that PC.  The V5R3 PTF will be available by end 
of June.  The V5R2 PTF will be available this Fall.
______________________________________________
Design Change Requests
IBM eServer iSeries
DCRREQ@xxxxxxxxxx




Charles Wilt
--
iSeries Systems Administrator / Developer
Mitsubishi Electric Automotive America
ph: 513-573-4343
fax: 513-398-1121