Re: CVE-1999-0467

[Bradley Stone <bvstone@xxxxxxxxx>]

If they found them, can't they tell you the qualified path to them?

Bradley V. Stone
www.bvstools.com
Native IBM i e-Mail solutions for Microsoft Office 365, Gmail, or any Cloud
Provider!

On Mon, Sep 24, 2018 at 9:37 AM Rob Berendt <rob@xxxxxxxxx> wrote:

> I'm getting dinged on a security audit.  The audit is reporting
> CVE-1999-0467.  This has not appeared on previous audits.  I looked that
> up and it basically says "The Webcom CGI Guestbook programs wguest.exe and
> rguest.exe allow a remote attacker to read arbitrary files using the
> "template" parameter."
> My initial impression was that I'm running IBM i, who gives a rat's
> posterior about .exe files?  Then I dutifully checked for the existence of
> these files throughout our entire IFS with a user with *ALLOBJ and all
> other special authorities.  These files simply do not exist.
> Still, I am willing to give the audit the benefit of the doubt and assume
> they are checking for the function of these files and not the files
> themselves.  But I do not know how to chase that dog any further.  Any
> ideas?
>
> Perhaps it's something else.  The CVE mentions the ability to modify the
> HTML form and get to those files.  Perhaps some recent security changes
> opened up our html forms to be modified?
> Again, I'm trying to keep an open mind.
>
> Anyone else experience this CVE or something very similar?
>
> What has changed since previous audits?
> - Zend was added for a bolt on.
> - IFS security was modified to meet Zend's (and the bolt on product)
> requirements.
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.