RE: DB2UDB hack

From: Jim Franz

So what (from IBM & other major software vendors)
requires PASE?
Websphere server?

WebSphere does not require PASE. Java does not require PASE. In fact, most
i5/OS software does not require PASE.

The other major piece of software not mentioned much but is an adapted
bit of non-IBM software - Apache webserver... and it is mentioned often in
the CERT Advisories over the years.

The pbA (powered by Apache) HTTP server is indeed based on the Apache code
base. However, again because of the architecture of i5/OS, it is not
subject to buffer overrun exploits. In fact, I'd be amazed if a single CERT
advisory on Apache actually applied to IBM's HTTP server.

Perhaps some of you are too young to remember the earlier DNS (not sure if
this same as Pat mentioned) that had IBM calling customers to load the
critical fix...
or the Common security group and their "demonstrations"...

Again, I'm not saying that i5/OS is perfectly secure. I've been pretty
specific about a class of exploits which are simply not applicable to native
i5/OS. This is probably the largest class of exploits, and they just can't
be executed on native i5/OS, primarily because of the strict separation of
program and data space.

It's amazing to me that on this list people don't understand exactly how
powerful our operating system is, and how (and why) it is essentially
invulnerable to an entire class of intrusions that plague all PC-type
operating systems.

Joe