From: dbuerger@cup.portal.com (David J Buerger)
Newsgroups: comp.sys.novell
Subject: Re: Leak in Novell
Date: Tue,  6 Oct 92 10:34:51 PDT
Organization: The Portal System (TM)
Distribution: world
  <1992Sep30.001353.17355@umr.edu> <jph.11@cc.ruu.nl> <will.718037499@ogre>
  <1992Oct2.130526.59386@cc.usu.edu> <71.2ad035c7@forthd.uucp>

It's strange that no one from Novell has officially responded
to this incident via the net. For those of you who are interested,
this press release just came over the business wire:

==================================================
BTR,F,5 - BC-NOVELL-RPT,    10-05 0001 02 - 
BW157   OCT  5,1992      11:30  PACIFIC      14:30 
EASTERN  ( BW)(NOVELL-RPT)(NOVL) NetWare security
update 
    Business Editors/Computer Writers
    REPEATING ... Due to line trouble
 
    PROVO, Utah--(BUSINESS WIRE)--Novell (NASDAQ:NOVL)
has verified  the existence of a threat to NetWare security. 
The mechanism for  intrusion was discovered and documented
by students and professors of Leiden University in the
Netherlands.  
    Since responding to the initial Leiden University program
with a  NetWire release, Novell has established an aggressive
two-phase  strategy to analyze, develop and verify solutions
to the broader  issues surrounding this threat.  Prior to
making enhancements widely  available, Novell will verify the
effectiveness of its approach by  delivering proposed
enhancements to an evaluation team of customers,  university
labs, user groups, industry security groups and other 
appropriate parties for validation.  
    "The security of our customers' networks has always been
of  utmost importance to Novell.  We have applied our top
development  resources to analyze the technical issues
surrounding this recent  development."  said Jan Newman,
executive vice president of the  NetWare Systems Group.  "We
are now accelerating our plans to deliver new levels of
security for the NetWare environment."  
    "Our customers' security needs continually evolve.  With
each  release of a network operating system, NetWare's
security features  are enhanced to meet those increasing
customer needs."  said  Ray Noorda, chairman and chief
executive officer of Novell.  
    "We find the Leiden University discovery to be very
valuable in  advancing our efforts to provide customers with
the most secure  networks in the industry."  
    Novell's security enhancements are scheduled to be
released in  two phases.  Phase I security enhancements will
encrypt network  protocol information from would-be hackers
who attempt to intercept  and interpret packets on the wire. 
Phase I enhancements are being  designed to apply easily to
existing NetWare 3.11, 2.2 and 2.15c  networks.  Phase I
enhancements will be available to our evaluation  partners
within two weeks.  
    Phase II enhancements will encrypt data moving across
the wire.  hase II enhancements will be available early next
year for those  customers who require the highest level of
security.  
    Phase I and phase II enhancements will be available as
optional  add-on products.  The current NetWare 3.11 and 2.2
network operating  systems will continue to ship in their
existing formats.  
    Systems with added security enhancements normally
experience some level of performance degradation.  The
performance cost to systems  employing Novell's forthcoming
phase I and phase II enhancements is  not currently known. 
Novell will employ all available techniques to  limit
performance degradation while ensuring the required levels of 
security.  Novell will provide customers with system
performance  benchmarks concurrent with the release of phase
I and phase II  security enhancements.  
    In the interim, Novell suggests that customers review
their  security procedures and inform their employees of
security risks.  We suggest that customers enable the security
features currently  available in NetWare, using the following
standard practices as a  minimum:  -0-T
    - Use the NetWare utility "SECURITY" to detect insecure
access        points to the  server.  
    - Require passwords on all accounts 
    - Force periodic password changes 
    - Require unique passwords 
    - Limit access rights and security equivalences 
    - Limit concurrent connections 
    - Enforce login time restrictions 
    - Enforce login station restrictions 
    - Enable intruder detection 
    - Secure unattended workstations to avoid unauthorized
use T -0-
  With these procedures enforced, as is the case throughout 
Novell's operations worldwide, NetWare users will continue to 
experience high levels of security with maximum performance. 

   There are many additional ways customers can more
securely  configure their networks.  Numerous third party
security add-on  products are available commercially.  The
range and scope of these  products give customers substantial
flexibility in establishing  security levels appropriate to their
particular business needs.   Novell will make every effort to
provide customers with information  on these third party
security products.  
    To receive ongoing security enhancement notifications
from  Novell, please call 800/NetWare and request that your
name be  included on our "Security Bulletin"  mailing list. 
You will receive  our Technical Application Note on Security
Issues; and, as phase I  and phase II security enhancements
become available, you will receive written notification and
system benchmarks showing the anticipated  performance
costs.  
    Novell Inc. is an operating system software company, the 
developer of network services, specialized and general purpose 
operating system software products including NetWare and DR
DOS.   Novell's NetWare network computing products manage
and control the  sharing of services, data and applications
among computer workgroups, departmental networks and
business-wide information systems.   
    --30--ahc/sf 
    CONTACT:  Novell Inc.               Terri Holbrooke,
801/429-5829               Martha Felt, 801/429-5811 
    KEYWORD:  CALIFORNIA
    INDUSTRY KEYWORD:  COMPUTERS/ELECTRONICS
PRODUCT                                                   
 REPEATS: New York 212-575-8822 or 800-221-2462; Boston
617-330-5311 or              800-225-2030; SF 415-986-4422
or 800-227-0845; LA 213-380-8383