Re: CVE-1999-0467

[Jon Paris <jon.paris@xxxxxxxxxxxxxx>]

He's have to have the door wide open for them to see them at all Brad.  Surely it is more likely to be a bad report.


Jon Paris

www.partner400.com
www.SystemiDeveloper.com

> On Sep 24, 2018, at 11:50 AM, Bradley Stone <bvstone@xxxxxxxxx> wrote:
>
> If they found them, can't they tell you the qualified path to them?
>
> Bradley V. Stone
> www.bvstools.com
> Native IBM i e-Mail solutions for Microsoft Office 365, Gmail, or any Cloud
> Provider!
>
> On Mon, Sep 24, 2018 at 9:37 AM Rob Berendt <rob@xxxxxxxxx> wrote:
>
> > I'm getting dinged on a security audit.  The audit is reporting
> > CVE-1999-0467.  This has not appeared on previous audits.  I looked that
> > up and it basically says "The Webcom CGI Guestbook programs wguest.exe and
> > rguest.exe allow a remote attacker to read arbitrary files using the
> > "template" parameter."
> > My initial impression was that I'm running IBM i, who gives a rat's
> > posterior about .exe files?  Then I dutifully checked for the existence of
> > these files throughout our entire IFS with a user with *ALLOBJ and all
> > other special authorities.  These files simply do not exist.
> > Still, I am willing to give the audit the benefit of the doubt and assume
> > they are checking for the function of these files and not the files
> > themselves.  But I do not know how to chase that dog any further.  Any
> > ideas?
> >
> > Perhaps it's something else.  The CVE mentions the ability to modify the
> > HTML form and get to those files.  Perhaps some recent security changes
> > opened up our html forms to be modified?
> > Again, I'm trying to keep an open mind.
> >
> > Anyone else experience this CVE or something very similar?
> >
> > What has changed since previous audits?
> > - Zend was added for a bolt on.
> > - IFS security was modified to meet Zend's (and the bolt on product)
> > requirements.
> >
> > Rob Berendt
> > --
> > IBM Certified System Administrator - IBM i 6.1
> > Group Dekko
> > Dept 1600
> > Mail to:  2505 Dekko Drive
> >          Garrett, IN 46738
> > Ship to:  Dock 108
> >          6928N 400E
> >          Kendallville, IN 46755
> > http://www.dekko.com
> >
> > --
> > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> > list
> > To post a message email: WEB400@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/web400
> > or email: WEB400-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at https://archive.midrange.com/web400.
> -- 
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.