what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

b-18.ciac-mvs-tso-reconnect

b-18.ciac-mvs-tso-reconnect
Posted Sep 23, 1999

b-18.ciac-mvs-tso-reconnect

SHA-256 | 39ff1676895af8c49a4679b9a180e82a38a66acc1d638edfe54e6214c0c1bac4

b-18.ciac-mvs-tso-reconnect

Change Mirror Download

FOR OFFICIAL DEPARTMENT OF ENERGY USE ONLY
_____________________________________________________
The Computer Incident Advisory Capability
___ __ __ _ ___
/ | / \ /
\___ __|__ /___\ \___
_____________________________________________________
Information Bulletin

March 11, 1991, 1330 PST Number B-18

MVS Security Problem with TSO Reconnect Facility
________________________________________________________________________
PROBLEM: MVS security problem with TSO Reconnect Facility
PLATFORM: IBM MVS systems running TSO
DAMAGE: Allows unintended reconnect to TSO address space from a
different term inal without appropriate terminal check or address space
modification
SOLUTIONS: IBM is working on a permanent solution, but an interim
workaround is to set reconnect time (RECONLIM) to 0 in SYS1.PARMLIB
(TSOKEYxx)
IMPACT OF WORKAROUND: Disallows the use of the TSO Reconnect Facility
for all users
_______________________________________________________________________
Critical TSO Reconnect Facility Information

CIAC has learned of a potential problem that exists in some IBM MVS
systems. This potential problem exists in MVS systems that support
TSO (Time Sharing Option) and a security package (e.g., RACF), and
also use special groups to grant access to information only at
designated locations (terminals). If uncorrected, this problem may
allow a user to reconnect to a previous session without resetting the
special group information. This may allow someone to bypass a
security feature that is designed to limit the access to sensitive
files to a particular set of terminals. Note that user IDs and
passwords are still required to reconnect a session using the TSO
Reconnect Facility. The problem, therefore, cannot result in
unauthorized access to systems.

IBM is aware of this problem, and is working toward a permanent
solution. An interim workaround has been devised. When the RECONLIM
parameter in the SYS1.PARMLIB(TSOKEYxx)* file is set to zero, any
given TSO session will immediately time-out and not allow the
reconnect facility to be activated. This will prevent a user from
disconnecting and using the Reconnect Facility to resume the session
at a later time. Only the Reconnect Facility address space will be
modified. No other address spaces will be affected by this change.

For additional information or assistance, please contact CIAC:

Tom Longstaff
(415) 423-4416 or (FTS) 543-4416, or

Call CIAC at (415) 422-8193 or (FTS) 532-8193 or
send e-mail to ciac@cheetah.llnl.gov.

Send FAX messages to: (415) 423-0913 or (FTS) 543-0913
_____
* - The TSOKEY is delivered from IBM with the version TSOKEY00, but
many sites have modified this to be some other number, for example
TSOKEY01. The RECONLIM parameter should be modified in the appropriate
SYS1.PARMLIB file used during the system IPL (Initial Program Load).

Tim Harrington provided information contained in this bulletin. This
document was prepared as an account of work sponsored by an agency of
the United States Government. Neither the United States Government nor
the University of California nor any of their employees, makes any
warranty, express or implied, or assumes any legal liability or
responsibility for the accuracy, completeness, or usefulness of any
information, apparatus, product, or process disclosed, or represents
that its use would not infringe privately owned rights. Reference
herein to any specific commercial products, process, or service by
trade name, trademark, manufacturer, or otherwise, does not necessarily
constitute or imply its endorsement, recommendation or favoring by the
United States Government or the University of California. The views and
opinions of authors expressed herein do not necessarily state or
reflect those of the United States Government or the University of
California, and shall not be used for advertising or product
endorsement purposes.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close