From: jrd@cc.usu.edu
Newsgroups: comp.sys.novell
Subject: Re: Leak in Novell
Date: 30 Sep 92 01:13:39 MDT
Organization: Utah State University

In article <1992Sep30.001353.17355@umr.edu>, rfranken@mcs213i.cs.umr.edu (Richard Brett Frankenberger) writes:
> In article <vermeulen.4.0@rulwinw.LeidenUniv.nl> vermeulen@rulwinw.LeidenUniv.nl (Hans Vermeulen) writes:
>>
>>As the writers of the program HACK.EXE (Novell fix: SECURE.ZIP) we would
>>like to say the following: it is hardware independent, it will work on
>>any type of hardware as long as IPX has been loaded. We have tried it on
>>our Ethernet and Token-Ring networks. The fix by Novell solves part of
>>the problem: it prevents a simple user from acquiring additional rights,
>>but at the same time it disconnects the workstation the supervisor is
>>working on ....
>>
>>Hans Vermeulen.
>>
>>Mr W.A. van Spronsen
>>email: vspronsen@rulwinw.leidenuniv.nl
> 
> This appears to indicate that the program is NOT going into promiscous mode and
> monitoring packets over the network wire to get information required to
> emulate a workstation attached as supervisor.  (If it were, it would almost
> certainly be hardware dependant.  Also, IBM Token-Ring cards CANNOT be
	<interesting technical comments omitted>
> our servers already.  Novell did well in releasing its NLM, but I still would
> like to know exactly what the problem is that I am fixing.  When I take my car
> into the garage, I don't say fix it, then leave and come back when its done, I
> also ask exactly what was wrong.  This is NOT intended as a flame, and I 
> respect everyone's opinion, but I think this information would benefit
> everyone.)    
> 
> As for the suggestion that we discuss this and future security breaches with  
> Novell, maybe it will work (I have no experience ever dealing directly with
> Novell), but I would imagine that discussing it on the net gets much better
> results.  (If I call up and say I've found a hole, they may say No, its
> nothing, it won't work, don't worry about it, but if I post NEWHACK.EXE to the
> net and hundreds of system administrators (and granted, some hacker/crackers
> also) download it and see for themselves that IT DOES WORK, Novell HAS to
> respond.  Same as asking a politician about some scandelous subject, he simply
> denys it and moves on ... write a well-documented article about it in a
> Newspaper, and he has to respond).
>  
>      - Brett   (rfranken@cs.umr.edu)
-------------
	Generally good thoughts here. My concern is the exposure of all
the other sites. Suppose you did know the full details, but after NW had
been throughly protected? Would that suffice, or is immediate info a real
requirement?  Are the bases (plural, can't spell) of some other patches,
say the recent NW 3.11 Fat fix, of vital importance too?
	I suppose one answer would be, Well if it's tapping the wire and
I'm on a system which has no-promiscuous-mode boards then I should be safe.
In this case you probably would not be safe. And you would have trouble running
DEC's Pathworks for DOS too. From what I know, and I don't have all the details
either, there is no external protection mechanism at this time. So the blocking
needs to be done in the server, using magic and an appropriate number of 
sacrifical chickens. Hmmm, the chicken part does complicate things, pesky
Romans.
	Would Novell reveal details to a willing and strong worker? I don't
know. Worth trying if one feels strongly about it and is willing to be
discrete.
	Here's a part that bothers me a little: we know there are always
small openings in every system, and covers to them have openings somewhere
too, and so on. As the covers mount up the performance or easy of operation
or easy of maintenance go down. There is no end to it. There has to be some
middle ground where we feel reasonably comfortable, that someone (vendor) is
keeping an eye on the store, and our systems are still nice to use. I don't
know where that ground is located. I thought I was standing on it, and
basically I still do. But if newer crackers appear on the net then I start
thinking the public crackers are my problem rather than the network vendor.
        Joe D.