Re: URGENT !! PTFs to fix another integrity problem -- JAVA400-L

Ken,

Historically (clear back to the S/38 if I remember; definitely since day one
with the AS/400) "integrity" was KEY (IBM-speak) for a get it and apply it ASAP,
'nough said, deal...

As more and more folks come to the AS/400 new, I think the subtle meaning of
that is no longer interpreted the way it was... They walk the line between
tipping off the wrong crowd with too much information and not giving enough to
make you want to apply said PTF (unless you take "integrity" to be Nike for Just
DO It !!) :-)

Chuck

"Sims, Ken" wrote:

> Hi Jesus and the gang -
>
> The problem addressed by these PTFs does not involve unencrypting passwords.
> It involves being able to use DMPSYSOBJ commands to display cleartext
> passwords of anyone who is currently signed on.  I won't post the
> instructions, but suffice it to say that I did it on my own system and was
> able to see my own password.
>
> You think that IBM would put in the PTF letter as much information as I just
> gave above.
>
> Ken
>
> > -----Original Message-----
> > From: Maynez, Jesus JRZ [SMTP:maynezj@iwghd.com]
> > Sent: Wednesday, July 26, 2000 18:03
> > To:   'JAVA400-L@midrange.com'
> > Subject:      RE: URGENT !! PTFs to fix another integrity problem
> >
> >
> > I heard a programmer broke the AS/400 security and was able to unencrypt
> > the
> > AS/400 passwords. IBM released some PTFs in order to correct this hole.
> > However, I am not if they are the same PTFs.
> >
> >
> >       -----Mensaje original-----
> >       De:     francess@us.ibm.com [SMTP:francess@us.ibm.com]
> >       Enviado el:     Mi�rcoles 26 de Julio de 2000 2:17 PM
> >       Para:   JAVA400-L@midrange.com
> >       Asunto: Re: URGENT !! PTFs to fix another integrity problem
> >
> >       Excerpt from cover letter:
> >
> >       ..          5769SS1 5050 0000 SF63349 2924 R04M00    0004     0000
> >       ., INTEGRITY PROBLEM.
> >
> >       PTF/FIX #: SF63349 - OPERATING SYSTEM/400
> >       LICENSED PROGRAM: 5769SS1
> >
> >
> > --------------------------------------------------------------------------
> > -
> >       :  SYSTEM : RELEASE :  LEVEL  : RECOMPILE : LIBRARY  :  MRI   :
> > APAR     :
> >       :         :         : MIN/MAX :           :          : FEATURE:
> > FIXED    :
> >       :         :         :         :           :          :        :
> > :
> >       :  AS/400 : V4R4M0  :  00/00  :     N     :   QSYS   :  NONE  :
> > SA89961  :
> >
> > --------------------------------------------------------------------------
> > -
> >
> >       PRE/CO-REQUISITE PTF/FIX LIST
> >       -----------------------------
> >       REQ  LICENSED      PTF/FIX  LEVEL
> >       TYPE PROGRAM  REL  NUMBER   MIN/MAX  OPTION
> >       ---- -------- ---  -------  -------  ------
> >       NONE
> >
> >
> >       DESCRIPTION OF PROBLEM FIXED FOR APAR SA89961 :
> >       -----------------------------------------------
> >          INTEGRITY PROBLEM.
> >
> >       CORRECTION FOR APAR SA89961 :
> >       -----------------------------
> >          INTEGRITY PROBLEM.
> >
> >       CIRCUMVENTION FOR APAR SA89961 :
> >       --------------------------------
> >          INTEGRITY PROBLEM.
> >
> >       ACTIVATION INSTRUCTIONS :
> >       -------------------------
> >          None.
> >
> >       SPECIAL INSTRUCTIONS :
> >       ----------------------
> >          This PTF corrects a security problem.  The problem addressed with
> > this
> >          PTF is different than the problem addressed in APAR SA89495.  The
> >          potential exists that your passwords may have been compromised.
> >          Therefore, after the application of this fix you may wish to
> > change the
> >          passwords on your systems.
> >
> >
> >
> >       Eric Merritt <cyberlync@yahoo.com> on 07/26/2000 02:17:12 PM
> >
> >       Please respond to JAVA400-L@midrange.com
> >
> >       To:   JAVA400-L@midrange.com
> >       cc:
> >       Subject:  Re: URGENT !! PTFs to fix another integrity problem
> >
> >
> >
> >
> >        What problems does this ptf fix?
> > This e-mail and any attachment contains information which is private and
> confidential and is intended for the addressee only.  If you are not an
> addressee you are not authorized to read, copy or use the e-mail or any
> attachment.  If you have recieved this e-mail in error please notify the
> sender by return e-mail and then destroy it.
>
> +---
> | This is the JAVA/400 Mailing List!
> | To submit a new message, send your mail to JAVA400-L@midrange.com.
> | To subscribe to this list send email to JAVA400-L-SUB@midrange.com.
> | To unsubscribe from this list send email to JAVA400-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner: joe@zappie.net
> +---

+---
| This is the JAVA/400 Mailing List!
| To submit a new message, send your mail to JAVA400-L@midrange.com.
| To subscribe to this list send email to JAVA400-L-SUB@midrange.com.
| To unsubscribe from this list send email to JAVA400-L-UNSUB@midrange.com.
| Questions should be directed to the list owner: joe@zappie.net
+---