Return-Path: <@VM1.CC.UAKRON.EDU:ps@jet.uk>
Newsgroups: bit.listserv.banyan-l
Date:         Wed, 6 Jan 1993 16:45:34 GMT
From:         ps@JET.UK
Subject: re: Passwords - Why Bother

Original Message

>>Find a Macintosh (1.2 or 1.3b6 software)
>>If it is already logged in, select the Chooser and click on logout.
>>Now you are logged out, click on login  this will present you with a
>>login screen complete with the name of the user already thoughtfully
>>typed in for you.
>>Randomly type a few characters on the keyboard, and press return.
>>Wait a few seconds for VINES to inform you that you are logged in.
>>
>>This is fully repeatable!


From:           "Brent A. Waechter" <BAWAECHT@CORPSB.REMNET.AB.COM>

>Re: Security Breach on MacIntoshes.
>
>We found this problem ourselves some time ago and have since applied
>the CY-1 patch.  The CY-1 patch FIXES the problem.
>
>In addition, the problem only existed when the VINES file service was
>mounted from the MAC client prior to logging out of VINES.  Since this
>was most of the time, it was a BIG problem.  However, since the patch
>was installed, we cannot duplicate it any more.

From:           Patrick=Smoker <Patrick=Smoker@admin.uucp>

>I can not duplicate this using 1.3 with patch 5.00(5)-CY-1 applied.  When
>following your instructions, I get the message...
>
>        "Invalid username/password pair or server is
>        unavailable"
>
>I repeated it a dozen times with the same result.  Perhaps the problem was
>quietly fixed with the CY-1 patch.  Is it applied on you system?

Continued . . .

So I rushed out and got hold of 5.00(5)CY-1 (and DR-1 & DU-1 for good measure)
but guess what, no difference.
However, all our Mac's automatically load a VINES file volume, and experiments
show that having a volume mounted is essential, therefore;

  First, using the chooser, select AppleShare and mount a VINES file volume
  from a VINES 5.00(5) server.

  If it is already logged in, select VINES in the Chooser and click on logout.

  Now you are logged out, select VINES from the Chooser and click on login
  this will present you with a login screen complete with the name of the
  user already thoughtfully typed in for you.

  Randomly type a few characters on the keyboard, and press return.

  Wait a few seconds for VINES to inform you that you are logged in.

Perhaps anyone can confirm this for me, it is still repeatable on ALL our
Mac's (SE's and IIci's)

Regards

Paul Simmonds
VINES Network Manager

+-----------------------+-----------------------------------------------------+
| Paul Simmonds         | Voice  : +235 528822 ext 4609 (+235 464609 direct)  |
| CODAS Division        | FAX    : +235 464404                                |
| JET Joint Undertaking | E-mail : ps@jet.uk (UK & World)                     |
| Abingdon              | X.400  : G=Paul;S=Simmonds;OU=CODAS;ON=JET;PD=JET;  |
| Oxfordshire           |          (C=GB;AD=GOLD 400;  Number:234284400235)   |
| OX14 3EA              |-----------------------------------------------------|
| United Kingdom        | JET is Europe's (EC Funded) Fusion Research Project |
+-----------------------+-----------------------------------------------------+
| Disclaimer: Any views expressed are mine, and do not reflect those of JET   |
+-----------------------------------------------------------------------------+