RE: OS/400 Vulnerability to CERT Advisories

This would be great if only I didn't need to be Houdini to get logged in.
What's so secret that I need to login for this information?

---
Doug Hart
?



>
>
> I would like to publicly thank Patrick Botz and IBM for providing this
> information. Thru midrange-l, Common, and directly with IBM, many
> have been asking for this from IBM. It will make security administration
> and notification to management much more complete.
>
> jim franz
>

>
> >
> > Hi Everyone,
> >
> > I wanted to give you a heads up to some new information that is
> available
> > for you regarding OS/400 and CERT Advisories.
> >
> > Go to:
> > http://www.ibm.com/servers/resourcelink     and sign-in
> > (you can request an ID/pwd for free, but it does require a sign-on)
> >
> > Then select "Problem Solving" from the left-hand navigation panel
> > Then select "Security alerts" (under the Alerts heading)
> >
> > You will see a list of CERT advisories and you can find the OS/400
> position
> > with respect to those advisories.
> >
> > In most cases, you will not see OS/400 responses for things that are
> > clearly not OS/400 related (i.e. CERT advisories for specific
> products or
> > platforms).
> >
> > Here's an example of the screen you'll see:
> >
> >
> >
> >
> >
> >
> >  CERT VU#623217
> >
> >                 Cryptographic weakness in Kerberos Version 4 protocol
> >
> >  · AIX · os400 · xSeries · zOS
> >
> >
> >
> >
> >
> >  CERT VU#673993
> >
> >                 PopTop PPTP Server contains buffer overflow in
> "ctrlpacket.c"
> >
> >   · os/400 · xSeries · zOS
> >
> >
> >
> > Clicking on OS/400 (or os400 or os/400 :-) ) will give you the
> information
> > about if and how OS/400 is affected. If it is affected it will give you
> > information about work arounds or PTFs.
> >
> > I'll give you a hint:  most of the OS/400 responses say "given currently
> > available information, OS/400 is not affected by this vulnerability."
> >
> > Patrick Botz
> > Senior Technical Staff Member
> > eServer Security Architect
> > (507) 253-0917, T/L 553-0917
> > email: botz@xxxxxxxxxx
> >

>