Re: Is message id TCP12AF a security risk?

Actually the problem was this:
...AND MESSAGE_TEXT LIKE '%V7R5M0%'

Now I find it with the following. Thank you

SELECT *
FROM QSYS2.MESSAGE_FILE_DATA
where MESSAGE_TEXT LIKE '%OS/400%'

*-- AND MESSAGE_TEXT LIKE '%V7R5M0%'*

I could fudge up the message a little by removing OS/400 from TCP1222.
However that wouldn't fix how parameter &1 gets filled in.
The TCP/IP version is "&1".


On Tue, Jan 9, 2024 at 2:58 PM Bryan Dietz <bdietz400@xxxxxxxxx> wrote:

DSPMSGD RANGE(TCP1222) MSGF(QTCP/QTCPMSGF)

need an "F" for the message file

Bryan

Dan Bale wrote on 1/9/2024 9:19 AM:

select *
FROM QSYS2.MESSAGE_FILE_DATA
where Message_File_Library = 'QTCPMSG';

^ returned no rows. Hmmm.

Not a fan of message text = &1. I was going to suggest just changing

the message text for TCP12AF to "Hello" or somesuch, but with &1, who knows
what else IBM uses it for?

- Dan

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of

Rob Berendt

Sent: Tuesday, January 9, 2024 8:31 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx

Subject: Is message id TCP12AF a security risk?

Originally I was thinking that the subject line was the issue. But now

I'm not so sure. Let me back up...

When I ftp from one IBM i to another, after I log in I get:
OS/400 is the remote operating system. The TCP/IP version is "V7R5M0".
If you hit help on that you will see that the message id is TCP12AF.
However, I do not get this message when I ftp from my pc dos client.
Why is this a concern? Well if nefarious people know the OS you are

running on, and the version, they may be able to focus their attack vector
more.

One thing nice is that IBM obfuscates TCP12AF and uses the name of an OS

that has long been obsoleted.

Actually if you do DSPMSGD RANGE(TCP12AF) MSGF(QTCPMSG) you will see

that the whole content of the message is data returned to it by the remote
server.

Thus the question really becomes: how do I stop my IBM i from supplying

the OS name and it's version?

I tried querying every message file on the system to see if that is

where this is stored by running this:

select *
FROM QSYS2.MESSAGE_FILE_DATA
where MESSAGE_TEXT LIKE '%OS/400%' AND MESSAGE_TEXT LIKE '%V7R5M0%';

But it didn't find any hits.

There may be legal reasons why you do not want to publish the version of

the OS. NDA possibly.

*** CONFIDENTIALITY NOTICE: The information contained in this

communication may be confidential, and is intended only for the use of the
recipients named above. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution, or
copying of this communication, or any of its contents, is strictly
prohibited. If you have received this communication in error, please return
it to the sender immediately and delete the original message and any copy
of it from your computer system. If you have any questions concerning this
message, please contact the sender. ***

--

-- .
Bryan
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.