Is

[Guest.Visitor]

Is

Doug - I agree with you totally. I would like to point out that an exploit such as the one described in the PHRACK article would require some relatively high level of system access in order to compile and replace (or add) the exit point program. I would suppose that it would be the same high level of system access as that described by John Earl in this thread for the DMPSYSOBJ command. Either of these two exploits would be effective on a system with neglected security but I have my doubts as to how effective each would be on a system where security is something other than a passing thought. I believe that is also your point - pay attention to the security of your system. Thanks, Steve

[D.Handy]

Is

Steve, I would suppose that it would be the same high level of system access as that described by John Earl in this thread for the DMPSYSOBJ command. By default, anyone in the QSYSOPR group or QPGMR group has access to DMPSYSOBJ. That's likely more than really *need* access to it. IMHO, it would be better to restrict access, then for contingency's sake create a program which adopts authority to run it but logs the usage for notification and review. You also should periodically check for new or changed programs which adopt authority which could harbor a trojan horse. As they say: "Beware of geeks bearing gifts." but I have my doubts as to how effective each would be on a system where security is something other than a passing thought. In general I agree with you, but in the case of the MI or RPG program exploit even relatively careful administrators are at risk without the PTF's. And usage of it wouldn't show up in the normal things to watch for. I believe that is also your point - pay attention to the security of your system. Correct. Which means also paying attention to catch things like changes to exit programs, programs which adopt authority, securing you signon display file from changes, limiting physical access to the CPU and backup tapes, controlling access to offsite copies of backups, etc. This really is a large topic. And one which people like John Earl are better qualified to address than myself. Doug