Shellshock resources

How can I find out more about Shellshock ? I've used the resources listed to understand the Shellshock vulnerability. Vulnerability Summary for CVE-2014-6271 Bash 'shellshock' scan of the Internet CVE-2014-6271: remote code execution through bash Patch Bash NOW: 'Shellshock' bug blasts OS X, Linux systems wide open Resolution for Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169) in Red Hat Enterprise Linux Read more →

How to check DB2 SYSADM or SYSCTRL authorization for a user with AUTH_LIST_AUTHORITIES_FOR_AUTHID

Question: How can I determine if a user has SYSADM or SYSCTRL authorization? I've read the DB2 - A Security Primer , but couldn't locate any commands Answer: Use the AUTH_LIST_AUTHORITIES_FOR_AUTHID table function. The function has replaced the get authorizations command. The function returns authorities granted to an ID directly or indirectly Syntax example using AUTH_LIST_AUTHORITIES_FOR_AUTHID Return authorities granted to user JACK , either explicitly or via a role or group SELECT AUTHORITY, D_USER, D_GROUP, D_PUBLIC, ROLE_USER, ROLE_GROUP, ROLE_PUBLIC, D_ROLE FROM TABLE (SYSPROC.AUTH_LIST_AUTHORITIES_FOR_AUTHID ('JACK', 'U') ) AS T ORDER BY AUTHORITY Read More on DB2 security DB2 – Audit Failed... Read more →

DB2 – Audit Failed logons

Troubleshooting DB2 failed logon attempts is an important part of DB2 databases security management. Beyond establishing security threats , such as hacking or viruses , the purpose of troubleshooting can extend to discovering application issues. For example , there may be an application in the Development environment , that has JDBC connection pointing to a Production environment. This can have a disastrous impact on Production data. Ideally, an environment should have Development, Test,QA, Production servers split out into separate OUs , and there should be necessary blocks in place to exclude connection attempts across the different domains. Nevertheless, it does... Read more →

Troubleshooting ADM13001E IBMOSauthclient and db2secGetDefaultLoginContext

2012-03-14-21.59.22.121301+000 E1040722932E430 LEVEL: Severe PID : 26754 TID : 182956718112 PROC : db2bp INSTANCE: db2my NODE : 000 FUNCTION: DB2 UDB, bsu security, sqlexGetDefaultLoginContext, probe:150 MESSAGE : ADM13001E Plug-in "IBMOSauthclient" received error code "-2" from the DB2 security plug-in API "db2secGetDefaultLoginContext" with the error message " ". Determines the user associated with the default login context, in other words, determines the DB2 authid of the user invoking a DB2 command without explicitly specifying a user ID The db2secGetDefaultLoginContext API returns the user of the default login context. In the situation , where a DB2 command is executed , but a... Read more →

DB2 SET CURRENT SCHEMA

Within a database multiple SCHEMAS can exist. If a table or view exists in a schema different from the default SCHEMA of the logon and the reference to the object does not include a qualified name , then the object can’t be found. For example , you may want to do a db2 list tables and view the list pf tables from another schema. Use the SET CURRENT SCHEMA method. For example , If the default SCHEMA is DB2TEST , and you want to view the tables of the schema DB2OTHER do: db2 set current schema = DB2OTHER See Also... Read more →