RE: IBM's benevolent hacking

["Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>]

Let me get this straight.  You contracted with IBM for a security
assessment, and they gave you a document in which there was at least one
issue that was a TCP/IP security problem.

This is where I get confused.  I don't know what a "TCP/IP level of
service" is, but from your post, it seems there is a fix that involves
some sort of patch to TCP/IP that is not available and will never be
made available on OS/400.

In summary, IBM has informed you of a security risk in the OS/400
implementation of TCP/IP that IBM has said will not be fixed.  Is that
correct?  If so, I'm sure I can find someone who has an opinion on that
matter.

A couple of other questions may help.  Is this problem fixed in pSeries
or xSeries boxes?  Is it fixed by other OS vendors?  Is this problem
something inherent in the RFC793 specification?  Has there been some
additional RFC written that addresses this deficiency?

Joe

> From: rob@xxxxxxxxx
> 
> Some are OS/400 TCP/IP specific.  I've opened PMR's and was told the
newer
> level of service is not offered under OS/400.  There was no plan on
going
> to that level of service.  So I don't know if I should throw chairs,
open
> DCR's or both.