RE: DB2UDB hack

From: Patrick Botz

The word "documented" is what makes the statement meaningless.

I know for a fact that the statement "has never been a case of any sort of
buffer overrun, virus, or indeed anything else on a native i5/Os
system..." (not the lack of the word "documented" in this statement....
It is this statement that I know for a fact is not true.

Thanks.

This is quickly devolving into basically us having to trust your word,
Patrick. You're saying that you know something that we don't that makes the
System i vulnerable.

I personally think that's bunk.

So let's try one last time, shall we? Is there currently an existing
vulnerability in V5R4M5 of i5/OS wherein an external agent can via TCP/IP
gain access to data or execute a program to which they are not authorized?

If the answer is no, then i5/OS is more secure than Windows, and this is
just a semantic digression. If the answer is yes, then I demand you prove
it, because it is a vulnerability in my system.

If the answer is "there was one, but we fixed it" then when was it fixed?

If the answer is no, is there a vulnerability other than TCP/IP by which an
external agent can gain access to data or programs to which they are not
authorized?

Again, if the answer is no, then I don't know what we're discussing. If
it's yes, then what is the route? I don't need to know specifics, just the
communication point. SNA? TELNET? Remember, it has to be external,
meaning it can't involve physical access to the System i. If it's
command-line access, then that's a completely different animal.

Really, Patrick, your argument boils down to, "The System i is vulnerable
and I know it." Whereas my argument is that Windows is vulnerable, and the
whole world knows it.

Joe