From:	CSBVAX::MRGATE!munnari!fac3.anu.oz.au!gih900@uunet.UU.NET@SMTP 16-MAY-1988 03:49
To:	ARISIA::EVERHART
Subj:	NEWS Posting to comp.os.vms


Received: from uunet.UU.NET by KL.SRI.COM with TCP; Wed 11 May 88 22:21:28-PDT
Received: from munnari.UUCP by uunet.UU.NET (5.54/1.14) with UUCP 
	id AA20691; Thu, 12 May 88 01:21:22 EDT
Message-Id: <8805120521.AA20691@uunet.UU.NET>
Received: from fac3.anu.oz (via ccadfa) by munnari.oz with SunIII (5.5)
	id AA12974; Thu, 12 May 88 14:34:27 EST
Received: by anu.anu.oz (1.2/4.7)
		id AA03890; Thu, 12 May 88 08:35:26 est
Date:  Thu, 12 May 88 08:35:26 est
From: munnari!fac3.anu.oz.au!gih900@uunet.UU.NET (GEOFF HUSTON)
To: info-vax@kl.sri.com
Subject: NEWS Posting to comp.os.vms

Path: fac3!gih900
From: gih900@fac3.anu.oz (GEOFF HUSTON)
Newsgroups: comp.os.vms
Subject: VAX PSI Security Posting
Message-ID: <193@fac3.anu.oz>
Date: 12 May 88 08:35:08 GMT
Organization: Computer Services, Australian National University
Lines: 63

I followed the recent debate in this newsgroup on VMS Security issues, and have
some sympathy with the Digital line that they wish to issue security patches
without explaining precisely what is being fixed, and ensure as far as possible
that the patch only reaches system managers of VMS systems. 

However there is an equally valid argument to inform as many system managers as
quickly as possible when supplied software has security problems. 

Accordingly I am posting this message (verbatim as I received it) to the net,
and have included the relevant headers to indicate the original source of the
message. I HAVE NOT CONFIRMED WITH DIGITAL THAT THIS IS AN "OFFICAL" PATCH. If
you are unsure whether to apply the measures suggested here, then perhaps you
may wish to follow up with your local Digital software support. 

----------------------------------------------------------------------------
 Via:  UK.AC.RUTHERFORD.VAX-E ;  Wed, 27 Apr 88 12:36 BST
            (V39 at UK.AC.RUTHERFORD.GEC-B)
 Date: Wed, 27 APR 88 12:36:11 GMT
 From: SUPPORT@UK.AC.RL.VE
 To:	  VMS-COMMS@UK.AC.RL.GB
 Subject: Security!!!!!

 *********************************************************************
 *******                                                    **********
 *******          IMPORTANT SECURITY MESSAGE                **********
 *******                                                    **********
 *********************************************************************

 To VAX/VMS Managers,

 I have been contacted by DEC and asked to forward this information to you.
 There is a security loophole in the current VMS system (as discussed at the
 last SERC VAX/VMS User Group). In order to overcome this problem please
 deinstall the NETTRACE image on your system and remove the command procedure
 SYS$MANAGER:NETTRACE_INSTALL.COM. (This will prevent the image being
 reinstalled at the next reboot and will not effect the running of PSI at all.)
 To do this : 

 $ INSTALL == "$SYS$SYSTEM:INSTALL/COMMAND_MODE"
 $ INSTALL REMOVE SYS$SYSTEM:NETTRACE
 $ RENAME SYS$MANAGER:NETTRACE_INSTALL.COM;* SYS$MANAGER:NETTRACE_NOINSTALL.COM

 All users on the system will still have access to PSI TRACE but due to the
 fact that the image is no longer installed with privileges certain operations 
 will not be accessible to non privileged users.

 PLEASE DO THIS NOW WHATEVER VERSION OF PSI YOU HAPPEN TO BE RUNNING.

 Regards
 Sue Weston

 P.S. This message is being sent to a number of mailing lists, apologies if
     you receive it more than once.

----------------------------------------------------------------------

-- 
Geoff Huston    Computer Services Centre, Australian National University
                GPO Box 4, Canberra, ACT 2601 AUSTRALIA

ACSnet,CSNET:	gih900@fac3.anu.oz    INTERNET: gih900%fac3.anu.oz@uunet.uu.net
UUCP: {uunet,ubc-cs,nttlab,mcvax,ukc}!munnari!fac3.anu.oz!gih900
PSI_MAIL:  PSI%505262440032::gih900
