Back to list
Canonicalization and directory traversal in iSeries FTP security products
Apr 20 2005 11:43PM
Shalom Carmel (shalom venera com)
Canonicalization problems in iSeries FTP security products
The IBM iSeries (AS/400) server provides a unified access scheme, called
to all of the files and to all of the database tables in all of the database
Because the built-in FTP server provides full access to the IFS, a valid,
can access and retrieve via FTP all of the database tables and all of the
files that he has
authority to access, based on the server assigned object authority.
This problem is usually addressed by third party iSeries security products
that attempt to limit FTP users only to the assets they should have access
For example, these products supposedly can limit access to a folder called
/home/bp/outgoing , so while getting a file called
getting a file called
Several iSeries security products have been found to be vulnerable to
a canonicalization attack resulting in a possible unauthorized access to
database tables that were supposedly blocked from access.
For example, these products allows this FTP command:
The following iSeries security vendors were approached to see whether
their products are vulnerable to this canonicalization attack.
RazLee: notified on Feb 15, fix is available.
Castlehill: notified on March 15, fix is available.
Powertech: notified on March 15, fix is available.
Bsafe: notified on March 2, vendor has no comment.
SafeStone: notified on March 15, no reply received.
NetIQ: notified on March 15, no reply received.
iSeries servers without FTP security protection are vulnerable by default.
Full explanation and technical details about the vulnerability can be found
[ reply ]
Copyright 2010, SecurityFocus