[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference noted::elfv3

Title:ELFV3
Moderator:MROA::GREGOIRE
Created:Thu Jun 29 1995
Last Modified:Mon May 19 1997
Last Successful Update:Fri Jun 06 1997
Number of topics:85
Total number of notes:352

81.0. "ELF V3.0 has Security Problems" by NNTPD::"burton@zeke.enet.dec.com" (Jim Burton) Tue Apr 22 1997 13:21

There appears to be a serious security problem with ELF V3.0.  Someone was 
able to get into my ELF entry and change the e-mail to my Exchange address.
What this did is it routed my mail to an Exchange account I don't use yet.
I will be taking the Exchange class in mid-May and having Exchange installed
at about the same time.  Could someone investigate the security breach?  I
will be taking all of my information off of ELF V3.0 until this security
problem can be fixed.

Jim
[Posted by WWW Notes gateway]
T.RTitleUserPersonal
Name
DateLines
81.1Some holes in the processTHEBAY::WIEGLEBLast day is May 2. Farewell!Tue Apr 22 1997 20:1618
    Unfortunately, this change of default mail address to Exchange is
    someone's mistaken "good idea" and has been going on for some time,
    without any warning to the people who are affected and much to their
    detriment, since they start "losing mail" to a mailbox that they don't
    yet use and don't know is in use.
    
    Also be aware that regardless of where your ELF entry points your mail,
    the majority of Exchange users are not using ELF anyway, so they end up
    sending mail to your Exchange account whether you like it or not,
    because the Exchange Global Address List points them at that mailbox.
    
    This could have been fixed by having all Exchange users use ELF as
    their primary directory and allowing the ELF entry to be changed by the
    user from their old to new address when they are ready.  (Or, have
    their old "MTS" address route mail to Exchange rather than ALL-IN-1.) 
    The current method has resulted in a lot of "lost" mail.
    
    - Dave
81.2This is really badNNTPD::"burton@zeke.enet.dec.com"Jim BurtonWed Apr 23 1997 17:1420
My phone has been ringing off the hook in the last few days from
irate field people who claim they have sent me dozens of e-mails
with no response from me.  The response from the ELF V3.0 support
people is:  

"Since you do have an Exchange account, when Exchange updates
Web ELF it puts your Exchange address in the internet address field. 
The exception is when there is lower case information in the internet
address field. Exchange will not modify any data that is in lower 
case. Your data is all in upper case. I suggest you remodify that 
attribute to all lower case, and your data should not get changed 
again."

When I went in to change the entry to lower case, it would not
accept the password I used successfully yesterday.  This ELF is
screwed up beyond belief!

Jim

[Posted by WWW Notes gateway]