[Info-vax] Kernel Transplantation (was: Re: New CEO of VMS Software)

[Simon Clubley]

On 2024-01-18, Lawrence D'Oliveiro <ldo at nz.invalid> wrote:
> On Thu, 18 Jan 2024 13:06:21 -0000 (UTC), Simon Clubley wrote:
>
>> On 2024-01-17, Lawrence D'Oliveiro <ldo at nz.invalid> wrote:
>>
>>> On Wed, 17 Jan 2024 13:11:31 -0000 (UTC), Simon Clubley wrote:
>>>> The server software with the vulnerability could be the DECnet stack
>>>> running on that server.
>>>
>>> Any reason why you think DECnet is particularly prone to introducing
>>> security holes, per se?
>> 
>> Because, at best, it has only had a very small fraction of the effort
>> spent on probing it that the mainstream network stacks have had.
>
> But we already know it is an insecure protocol, and we already know how to 
> run such things securely, as I pointed out before.

As I have already mentioned, that only protects data in transit.

If you can still reach the DECnet stack via the nice modern secure
protocol, you can still open your own connections to the DECnet stack
and launch attacks against the DECnet stack running on the server.

Simon.

-- 
Simon Clubley, clubley at remove_me.eisner.decus.org-Earth.UFP
Walking destinations on a map are further away than they appear.