RE: AS400 user password

Dan,

I cannot prove that this problem was not reported to IBM before last week.
I do know that if it was reported, that report never made it to the people
who care about AS/400 security.

In my opinion this was a speedy resolution to the problem. No one at IBM
Rochester, that I have talked to, knew anything about this problem until
last week.  In fact I was one of the first IBMers to sound the alarm when I
read about it. We produced all three PTFs in less than four working days
from the first report of the problem. In my opinion this was a severity 1
problem and it needed a quick fix.

The only thing I can say about the "security by obscurity" accusations is
that they are not true.  We fix our security problems.  Some fixes are much
bigger than others and take more time.

Ed Fishel

>However, I _am_ concerned with IBM's *seemingly* lack of speedy
resolutions
>to security exposures that others have said have been brought to IBM's
>attention.  I don't know how long IBM had this information before the
uproar
>of last week, but only a few days later, you came forward with the PTF
>solutions.  It appears that many of the elite group of MI experts that
>subscribe to the MI400 list have grown weary of waiting for IBM to even
>acknowledge that they know what they're talking about.  They appear to be
>genuinely concerned for the AS/400 community, whereas IBM's security team
>*appears* to be in the "security by obscurity" camp.
>
>All of this is based on hearsay, although it appears to be coming from
>trusted sources.  I am not asking you to divulge information that would
>further put the AS/400 community at risk, but I am asking for IBM (whether
>it be you or others higher up) to respond publicly to the accusations that
>have been flying around the MIDANGE-L & MI400-L.
>
>- Dan Bale
>
>> -----Original Message-----
>> From:  edfishel@us.ibm.com [SMTP:edfishel@us.ibm.com]
>> Sent:  Monday, June 12, 2000 9:33 AM
>> To:    MIDRANGE-L@midrange.com
>> Subject:    RE: AS400 user password
>>
>> >Ed -
>> >
>> >How does this PTF solve the "password sniffing" problem???
>> >
>> >Kenneth
>>
>> Kenneth,
>>
>> Subsystem monitor jobs use a single open for each 250 or so display
>> devices. So for example, if the subsystem supports 600 display devices,
>> there will be three opens and three input/output buffers. Each buffer is
>> used for the sign-on screens for only one set of devices.
>>
>> The fix provided by the PTFs is to blank out the password in the buffer
>> immediately after it is read into a local variable. The program that
does
>> this already blanked out its local variables when it was done verifying
>> the
>> users sign-on password.  Not blanking out the password in the input
buffer
>> was an oversight. I will not try to offer an excuse for why the
developer
>> missed this. (I am not that developer.)
>>
>> Ed Fishel,
>> IBM Rochester


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---