RE: DB2UDB hack

[Patrick Botz <botz@xxxxxxxxxx>]

They would have the rights of whatever userID under which the PASE 
application being attacked is running.  If this profile had *ALLOBJ 
security, they could do anything they wanted  on the entire system, not 
just in the PASE environment (PASE was designed to allow calls to native 
i5/OS stuff).  But even just using standard Unix file system commands 
(e.g. ls, cat, cp, rm, etc...), they could manipulate most of the data on 
the machine. 


Patrick Botz
IBM STG Lab Services Security Practice
botz@xxxxxxxxxx
work: 507 253 0917  mobile: 507 250 5644
http://www.ibm.com/systems/services/labservices

midrange-l-bounces@xxxxxxxxxxxx wrote on 10/22/2007 06:01:22 PM:

> My question is this, if a successful PASE buffer overflow is
> accomplished under i5/OS, what can the hacker hope to accomplish?  What
> rights would they have to the rest of the system?
>
> Chris Bipes 
> Director of Information Services 
> CrossCheck, Inc.