17 lines
No EOL
944 B
Text
17 lines
No EOL
944 B
Text
source: https://www.securityfocus.com/bid/4059/info
|
|
|
|
AS/400 is a midrange computer platform developed by IBM. It is designed to be highly reliable and efficient, and uses the OS/400 operating system.
|
|
|
|
An information disclosure vulnerability has been reported to exist in OS/400 systems. An authenticated user may be able to obtain a list of all valid user accounts. The user must be running a 5250 emulator.
|
|
|
|
The user may, after authentication, access the 'System Request' menu and obtain a list of all object names of type USRPRF. The 'System Request' feature is installed by default.
|
|
|
|
This information may be useful in attempting further, intelligent attacks against the vulnerable server.
|
|
|
|
Sign-on to AS/400
|
|
Issue system request (Shift + Esc key)
|
|
Hit enter
|
|
Choose option 3, display current job
|
|
Choose option 13, display library list
|
|
Choose option 5 next to library QSYS
|
|
Scroll down to view names of all objects of type *USRPRF (user profile) |