Original issue date: October 25, 1990<BR>
Last revised: September 17, 1997<BR>
Attached Copyright Statement

<P>A complete revision history is at the end of this file.

<P>The CERT/CC has received a report of a security vulnerability which
exists under specific conditions in Digital VMS Software  (Versions 4.0
to 5.4).  The DESCRIPTION, IMPACT, SOLUTION, and CONTACT INFORMATION
sections below have been provided to the CERT/CC by the Digital Equipment
Corporation.

<P><HR>


<H2>I. Description</H2>
Non-privileged users can acquire system privileges through
the ANALYZE/PROCESS_DUMP routine.
<H2>II. Impact</H2>


Non-privileged users who gain increased privileges might deliberately
or inadvertently affect the integrity of system information and/or
affect the integrity of the computing resource.
<H2>III.  Solution</H2>

Digital is currently working on a permanent solution to this 
problem.  While a permanent fix is being completed, Digital 
recommends that the following actions be taken on every VMS 
system (this includes all nodes in a VAXcluster system).


<P>After taking the following actions, non-privileged users will not be able 
to use the ANALYZE/PROCESS_DUMP command.
<OL><STRONG><LI>
 Log into the system account.</STRONG>

<P><STRONG>
<LI>$ SET PROC/PRIV=ALL</STRONG>

<P>
<STRONG><LI>  a)  For VMS versions prior to V5.0,</STRONG>

<P>Modify SYS$MANAGER:SYSTARTUP.COM to include the following lines:
<PRE>
		 $ SET NOON
                 $ MCR INSTALL ANALIMDMP.EXE/DELETE
 </PRE>
as the first two commands in this file.

<P>b)  For VMS versions V5.0 and later,

<P>Modify SYS$MANAGER:SYSTARTUP_V5.COM to include the following 
lines:
<PRE>
		 $ SET NOON
                 $ MCR INSTALL ANALIMDMP.EXE/DELETE
</PRE>
as the first two commands in this file.

<P>c)  For MicroVMS systems,

<P>The image ANALIMDMP.EXE is not installed by default, but 
SYSTARTUP.COM contains a suggestion for installing the image if 
you have multiple users on your system.  You must ensure that 
this image is not installed by SYSTARTUP.COM.  You can  use the
following command to verify that the image is not  installed:
<PRE>
                 $ MCR INSTALL ANALIMDMP/LIST
	</PRE>

<P>
<STRONG><LI>            $ MCR INSTALL ANALIMDMP/DELETE</STRONG>

<P>This command removes the installed image from the active system.

<P><STRONG>
<LI>(Optional) Restart your systems and verify that the image is not 
installed using the following command:</STRONG>

<PRE>
                 $ MCR INSTALL ANALIMDMP/LIST
 </PRE>
You should receive a message similar to the following:
<PRE>
	%INSTALL-W-FAIL, failed to LIST entry for ANALIMDMP.EXE
         -INSTALL-E-NOKFEFND, Known File Entry not found
</PRE>
</OL>

<P>For further questions, please contact your Digital Customer Support     
Center.

<P><HR>

<P>The CERT/CC thanks Digital for the information above, and thanks Clive
Walmsley, Royal Signal and Radar Establishment, Malvern England, for
reporting this problem to CERT/CC.

<P>
<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 1990 Carnegie Mellon University.</P>

<HR>

Revision History
<PRE>
September 17,1997  Attached Copyright Statement
</PRE>