The firm that furnished and installed Universe and converted the application programs has taken the position that Universe is installed in accordance with Ardent s published recommendations. This paper is intended to serve as a warning to all current and future users of Ardent Universe products that major security flaws exist . For the purpose of this document, adequate security is defined as a computing environment where data cannot be deleted or altered by unauthorized persons, and where unauthorized persons cannot disrupt reliable operation of the system. Environment Individual AIX login accounts exist for each user that is authorized to access the financial system. Users access the host by using a terminal emulation program on a PC with the telnet protocol.
Most printing is done via the network.
Some modems are provided for dial-in access. The application programs determine access privileges within the Universe environment. All user accounts belong to the same Unix user group. Permissions on all files in the Universe environment that are visible to the Unix file system have been set to 777 by the installation vendor. This means that any user with access to the Unix file system can delete and overwrite any Universe file.