Canonicalization problems in iSeries FTP security products Overview ------------ The IBM iSeries (AS/400) server provides a unified access scheme, called IFS, to all of the files and to all of the database tables in all of the database libraries. Because the built-in FTP server provides full access to the IFS, a valid, authenticated user, can access and retrieve via FTP all of the database tables and all of the files that he has authority to access, based on the server assigned object authority. This problem is usually addressed by third party iSeries security products that attempt to limit FTP users only to the assets they should have access to. For example, these products supposedly can limit access to a folder called /home/bp/outgoing , so while getting a file called /home/bp/outgoing/dailysales.csv is allowed, getting a file called /qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr is blocked. Several iSeries security products have been found to be vulnerable to a canonicalization attack resulting in a possible unauthorized access to iSeries database tables that were supposedly blocked from access. For example, these products allows this FTP command: Get /home/bp/outgoing/../../../qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr The following iSeries security vendors were approached to see whether their products are vulnerable to this canonicalization attack. RazLee: notified on Feb 15, fix is available. Castlehill: notified on March 15, fix is available. Powertech: notified on March 15, fix is available. Bsafe: notified on March 2, vendor has no comment. SafeStone: notified on March 15, no reply received. NetIQ: notified on March 15, no reply received. iSeries servers without FTP security protection are vulnerable by default. Full explanation and technical details about the vulnerability can be found at http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf
