PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICER
(ISSO), SPECIAL SECURITY OFFICER (SSO), INFORMATION RESOURCE MANAGER
(IRM) AND AUTOMATED DATA PROCESSOR (ADP) COORDINATORS
SUBJECT:  PROBLEM WHEN CALENDAR MANAGER IS USED IN COMBINATION WITH
VMS VERSION V5.5 AND PATHWORKS FOR VMS S4.1C (AUTOMATED SYSTEM
SECURITY INCIDENT SUPPORT TEAM (ASSIST) BULLETIN 93-05).
1.  ASSIST HAS RECEIVED INFORMATION CONCERNING SECURITY PROBLEMS IN
THE 'CALENDAR MANAGER' SOFTWARE APPLICATION WHEN IT IS RUNNING ON
VAX/VMS.  CALENDAR MANAGER IS A PRODUCT OF:
RUSSELL INFORMATION SCIENCES, INC.
115 COLUMBIA SUITE 100,
LAGUNA HILLS, CA, USA.
TEL +1 714 362-4000  FAX +1 714 362 4040
THE PROBLEMS HAVE BEEN CONFIRMED IN EACH VERSION OF CALENDAR MANAGER
PREVIOUS TO V4.0-10, WHEN THE APPLICATION IS RUNNING IN COMBINATION
WITH VMS VERSION V5.5 AND PATHWORKS FOR VMS S4.1C.  OTHER VMS AND
PATHWORKS PLATFORMS HAVE NOT BEEN EVALUATED AS OF THIS TIME, SO ALL
ADMINISTRATORS SHOULD ASSUME THE SECURITY OF ANY VERSION OF VMS AND
PATHWORKS WILL BE AFFECTED WHEN RUNNING CALENDAR MANAGER.
2.  DESCRIPTION OF THE PROBLEM IN ALL VERSIONS OF CALENDAR MANAGER
PRECEDING VERSION V4.0-10: INSTALLING IMAGES WITH PRIVILEGES IS A
FREQUENTLY USED WAY TO SHARE INFORMATION BETWEEN USERS IN A VMS
ENVIRONMENT.  CALENDAR MANAGER'S STARTUP PROCEDURE INSTALLS IMAGES
WITH ENHANCED PRIVILEGES.  IT IS POSSIBLE TO EXPLOIT THESE INSTALLED
IMAGES TO CREATE SECURITY PROBLEMS, AND REMOVING THE PRIVILEGES FROM
THE INSTALLED IMAGES SERIOUSLY RESTRICTS THE FUNCTIONALITY OF THE
SOFTWARE.
3.  AS A RESULT OF THE DISCOVERY OF THIS SECURITY PROBLEM, RUSSELL
INFORMATION SCIENCES HAS RELEASED A NEW VERSION OF CALENDAR MANAGER,
V4.0-10.  VERSION V4.0-10 ELIMINATES THE PROBLEMS DESCRIBED ABOVE
THAT EXIST IN ALL PREVIOUS VERSIONS OF CALENDAR MANAGER.  ALL DOD
SITES RUNNING ANY VERSION OF CALENDAR MANAGER UP TO V4.0-9 IN
COMBINATION WITH VMS AND PATHWORKS FOR VMS, SHOULD OBTAIN AND INSTALL
VERSION V4.0-10 ASAP.
4.  POINT OF CONTACT:  ASSIST POINT OF CONTACT FOR THIS MATTER IS
PETE HAMMES, COMM (703) 696-1924/5/6 OR DSN 226-1924/5/6.  ASSIST CAN
BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER (800) SKY-PAGE (800-
759-7243), PIN NUMBER 2133937.  WHEN CALLING THE PAGER SERVICE,
FOLLOW THE AUTOMATED VOICE INSTRUCTIONS AND ENTER THE CALL BACK
NUMBER AFTER THE PROMPT.  THE ASSIST DUTY OFFICER WILL CALL YOU BACK
WITHIN 30 MINUTES.  IF FASTER SERVICE IS REQUIRED, PREFIX YOUR
TELEPHONE NUMBER WITH "999", AND THE ASSIST DUTY OFFICER WILL CALL
BACK WITHIN 5 MINUTES.  ASSIST CAN BE REACHED VIA E-MAIL AT "DOD-
CERT(AT-SIGN)DDN-CONUS.DDN.MIL".
BT