On 3/13/2019 8:10 AM, Bill Bishop (TMNA) wrote:
Are there ways for a JBOSS call to infect a mainframe?
Any program in USS could conceivably execute malicious code with
whatever privilege the process launching it has.
If so, what would our options be to prevent other than a solid RACF environment?
* Don't run things in USS with a lot of privilege if you can avoid it.
* Follow advisories about open source vulnerabilities.
* Participate in the open source world and become more familiar with
what you're dealing with.
o Serious breaches of the code base of mainstream open source
projects like JBoss are fairly rare and usually caught quickly.
o Are you checking signatures correctly when you download and
install stuff to make sure you have the real goods?
--
Jack J. Woehr # Science is more than a body of knowledge. It's a way of
www.well.com/~jax # thinking, a way of skeptically interrogating the universe
www.softwoehr.com # with a fine understanding of human fallibility. - Carl Sagan
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
