RE: DB2UDB hack -- MIDRANGE-L

× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.

From: Patrick Botz

They would have the rights of whatever userID under which the PASE
application being attacked is running.

Just like ODBC or FTP or whatever, user profiles exposed to the outside
world (which I consider PASE to be) should be strictly limited.

If this profile had *ALLOBJ
security, they could do anything they wanted on the entire system, not
just in the PASE environment (PASE was designed to allow calls to native
i5/OS stuff).

Can you imagine any situation where you would want to have a PASE program
running with *ALLOBJ authority? I'm not being argumentative, I'm simply
saying that anything running inside of PASE should follow stringent
authority rules, and should only have access to the minimum objects it needs
to do its job.

But even just using standard Unix file system commands
(e.g. ls, cat, cp, rm, etc...), they could manipulate most of the data on
the machine.

But again, this is only an issue if the PASE profile has too much authority.
If the PASE profile is limited to a specific IFS folder, then that issue
goes away.

Joe

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.