| Newsgroups |
gmane.comp.systems.as400.security |
| Message-ID |
<[email protected]> |
Bob,
The original poster (Shalom) was suggesting that the fact that data can be
changed during runtime between the time the record is read / processed by
the program and the time the record makes it to the database (and journal),
there is a possible security hole.
I don't think that it is.
-mark
Original Message:
-----------------
From: Bob Crothers bob2-d6i/[email protected]
Date: Thu, 29 Jun 2006 13:39:33 -0400
To: security400-Zwy7GipZuJhWk0Htik3J/[email protected]
Subject: Re: [Security400] STRSRVJOB and database journal entries
But in the case below, isn't the Journal accurate?
Program reads in database record. Pgm changes data, hits break point before
the update is issued. Person uses CHGPGMVAR to change one of the fields and
then resumes execution. Record update is done. Journal accurately shoes
what the data was when the record was written/updated...AFTER the chgpgmvar!
Not seeing the problem.
Bob
> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] [mailto:security400-
> bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of mlazarus-sSJ1ceXosh9vBvnq28/[email protected]
> Sent: Wednesday, June 28, 2006 12:51 PM
> To: security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> Subject: Re: [Security400] STRSRVJOB and database journal entries
>
> You are also required to have at least *USE authority to the target job's
> *USRPRF. So, if the system in question has a gaping security hole
> (allowing the user to debug the job in the first place), I wouldn't expect
> IBM to log all changes to the journal, especially since those changes were
> to memory, not yet in the database.
>
> -mark
>
> Original Message:
> -----------------
> From: Hall, Philip [email protected]
> Date: Wed, 28 Jun 2006 11:31:15 -0500
> To: security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> Subject: Re: [Security400] STRSRVJOB and database journal entries
>
>
> > I started a debug session for another job, using chgpgmvar I changed a
> > program variable that was due to be written to a database file and then
> I
> > looked at the journal.
> > There was no trace of the fact that the job that wrote the modified
> value
> > was interrupted in any way.
> > This looks like a problem, doesn't it?
>
> Only if you put debug versions of your objects into production.
--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .
_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.