Re: Is message id TCP12AF a security risk?

[Rob Berendt <robertowenberendt@xxxxxxxxx>]

Probably because the library QTCPMSG doesn't exist?  Try changing the
column you're searching.  Maybe drop the _Library?

On Tue, Jan 9, 2024 at 10:20 AM Dan Bale <dan.bale@xxxxxxxxxxxxxxxxxxxxx>
wrote:

> select *
> FROM QSYS2.MESSAGE_FILE_DATA
> where Message_File_Library = 'QTCPMSG';
>
> ^ returned no rows.  Hmmm.
>
> Not a fan of message text = &1.  I was going to suggest just changing the
> message text for TCP12AF to "Hello" or somesuch, but with &1, who knows
> what else IBM uses it for?
>
> - Dan
>
> -----Original Message-----
> From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob
> Berendt
> Sent: Tuesday, January 9, 2024 8:31 AM
> To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
> Subject: Is message id TCP12AF a security risk?
>
> Originally I was thinking that the subject line was the issue.  But now
> I'm not so sure.  Let me back up...
> When I ftp from one IBM i to another, after I log in I get:
> OS/400 is the remote operating system. The TCP/IP version is "V7R5M0".
> If you hit help on that you will see that the message id is TCP12AF.
> However, I do not get this message when I ftp from my pc dos client.
> Why is this a concern?  Well if nefarious people know the OS you are
> running on, and the version, they may be able to focus their attack vector
> more.
> One thing nice is that IBM obfuscates TCP12AF and uses the name of an OS
> that has long been obsoleted.
> Actually if you do DSPMSGD RANGE(TCP12AF) MSGF(QTCPMSG) you will see that
> the whole content of the message is data returned to it by the remote
> server.
>
> Thus the question really becomes:  how do I stop my IBM i from supplying
> the OS name and it's version?
>
> I tried querying every message file on the system to see if that is where
> this is stored by running this:
> select *
> FROM QSYS2.MESSAGE_FILE_DATA
> where MESSAGE_TEXT LIKE '%OS/400%' AND MESSAGE_TEXT LIKE '%V7R5M0%';
>
> But it didn't find any hits.
>
> There may be legal reasons why you do not want to publish the version of
> the OS.  NDA possibly.
>
> *** CONFIDENTIALITY NOTICE: The information contained in this
> communication may be confidential, and is intended only for the use of the
> recipients named above. If the reader of this message is not the intended
> recipient, you are hereby notified that any dissemination, distribution, or
> copying of this communication, or any of its contents, is strictly
> prohibited. If you have received this communication in error, please return
> it to the sender immediately and delete the original message and any copy
> of it from your computer system. If you have any questions concerning this
> message, please contact the sender. ***
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.