ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexGeneral IBM MQ SupportMQ/Java client - security hole?

Post new topicReply to topic
MQ/Java client - security hole? View previous topic :: View next topic
Author Message
dutchman
PostPosted: Wed Feb 20, 2002 7:36 am Post subject: Reply with quote

Acolyte

Joined: 15 May 2001
Posts: 71
Location: Netherlands

The following situation has arisen which is giving me great cause for
concern. If I am right, then I think we have a large security hole in
MQSeries - I would love to be proved wrong.

The scenario occurs where a Java client attaches to a SVRCONN channel. If
you don’t use the MQEnvironment.userID variable, and you don't hardcode
the MCAUSER field as part of the SVRCONN channel, then the userid is
determined by the userid of the listener at the server end. This is “mqm” on
Unix machines and “MUSR_MQADMIN” on NT. This means that any Java program has
complete access to the MQ server queue manager including the ability to send
PCF commands. This does not happen to MQ 'C' clients.

Even if the MQEnvironment.userID value is provided, this is simply a String
variable and could easily be set to “mqm” or any other valid userid by a
rogue programmer.

So it would appear that "MQ out of the box" would allow anybody to connect
to a server via a Java client (if you haven't already got them - the code is
freely downloadable from the IBM web site). This includes connecting via the
“SYSTEM.DEF.SVRCONN” which is created automatically when MQ is installed and
"SYSTEM.ADMIN.SVRCONN". Yes, it is good practice to remove SYSTEM.DEF.SVRCONN.

The only way out of this that I can see is to provide channel security exits
at BOTH ends of the client channel to do proper authentication. So far so
good, but…

MQSI uses Java client connections for the “Config Manager” and it doesn’t
allow for security exits. This means that even if you plug the holes
detailed above, there will still be a pipeline into the server via MQSI’s
channels AND I DON’T SEE HOW TO PLUG THIS ONE!

BTW - the same applies of course to any other package which uses client
connections and doesn’t allow for security exits.

Anyone got any ideas?
Back to top
View user's profile Send private message Send e-mail
kolban
PostPosted: Sat Feb 23, 2002 7:54 am Post subject: Reply with quote

Grand Master

Joined: 22 May 2001
Posts: 1072
Location: Fort Worth, TX, USA

You are correct that if you want security, then you must use the security channel exits. The latest WMQI (aka MQSI) V2.1 provides security exit capability for the Control Center.
Back to top
View user's profile Send private message
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexGeneral IBM MQ SupportMQ/Java client - security hole?
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.