RE: DB2UDB hack

["Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>]

> From: Patrick Botz
>
> They would have the rights of whatever userID under which the PASE
> application being attacked is running.

Just like ODBC or FTP or whatever, user profiles exposed to the outside
world (which I consider PASE to be) should be strictly limited.


> If this profile had *ALLOBJ
> security, they could do anything they wanted  on the entire system, not
> just in the PASE environment (PASE was designed to allow calls to native
> i5/OS stuff).

Can you imagine any situation where you would want to have a PASE program
running with *ALLOBJ authority?  I'm not being argumentative, I'm simply
saying that anything running inside of PASE should follow stringent
authority rules, and should only have access to the minimum objects it needs
to do its job.


> But even just using standard Unix file system commands
> (e.g. ls, cat, cp, rm, etc...), they could manipulate most of the data on
> the machine.

But again, this is only an issue if the PASE profile has too much authority.
If the PASE profile is limited to a specific IFS folder, then that issue
goes away.

Joe