[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference minotr::security_advisory

Title:SECURITY_ADVISORY
Notice:Security is Everyone's Responsibility
Moderator:MINOTR::NOBLE
Created:Wed Dec 22 1993
Last Modified:Thu May 29 1997
Last Successful Update:Fri Jun 06 1997
Number of topics:148
Total number of notes:459

131.0. "CISG Security Bulletin 1997-02, VMS Delta-Time" by MINOTR::NOBLE (Your Data, Your Job...Protect Both) Sun Mar 09 1997 13:27

         DIGITAL INTERNAL USE ONLY
************************************************
*        CORPORATE SECURITY
*        CORPORATE INFORMATION SECURITY GROUP
*        Mar 07, 1997
*        SECURITY BULLETIN #1997-02
*
************************************************
[DO NOT DELETE THIS BANNER]


This security bulletin is for immediate distribution to all
OpenVMS/VAX and OpenVMS/AXP system managers, internal support
personnel and any other appropriate internal organizations within
Digital Equipment Corporation.  Cost Center managers hosting
contract personnel are responsible for ensuring appropriate
forwarding of this bulletin.


SUBJECT:  OpenVMS Delta-Time Limit Problem

The OpenVMS operating system has a documented delta-time limit that
may cause a serious error in some applications and OpenVMS
components beginning on or around 19-MAY-1997. DIGITAL has provided
ECOs (Engineering Change Orders) that remove the delta-time limit.


IMPACT:

OpenVMS customers may experience errors in some applications        
and OpenVMS components when dates are specified on or around
19-MAY-1997.

As identified further on, The OpenVMS SECURITY Server is one of the
known components to be affected  by the delta-time limit.  Symptoms
may involve denial-of-service, including system crash.


REQUIRED ACTIONS:

CISG strongly recommends all system managers running OpenVMS/VAX
V5.5 - V7.0, and/or OpenVMS/AXP V6.1 - V7.0 obtain and read the
cover letter and the README file to fully determine the impact to
their system.  System managers who determine or suspect that their
system(s) is impacted, should install the appropriate ECO for the
system(s) version they are running.


SECURITY KIT NAMES:

ECO:  ALPLIBR05_070, for OpenVMS/AXP V6.1 - V7.0
	FILE NAMES:
		ALPLIBR05_070.A-DCX_AXPEXE
		ALPLIBR05_070.B-DCX_AXPEXE
		ALPLIBR05_070.C-DCX_AXPEXE
		ALPLIBR05_070.CHKSUM
		ALPLIBR05_070.CVRLET_TXT
		ALPLIBR05_070.D-DCX_AXPEXE
		ALPLIBR05_070.README

ECO:  VAXLIBR05_070, for OpenVMS/VAX V5.5 - V7.0
	FILE NAMES:
	  	VAXLIBR05_070.A-DCX_VAXEXE
		VAXLIBR05_070.B-DCX_VAXEXE
		VAXLIBR05_070.C-DCX_VAXEXE
		VAXLIBR05_070.CHKSUM
		VAXLIBR05_070.CVRLET_TXT
		VAXLIBR05_070.D-DCX_VAXEXE
		VAXLIBR05_070.E-DCX_VAXEXE
		VAXLIBR05_070.F-DCX_VAXEXE
		VAXLIBR05_070.G-DCX_VAXEXE
		VAXLIBR05_070.README


SECURITY KIT LOCATIONS:

These ECOs are internally available from the following Security
Patch Server location:

    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V61] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V61-1h1] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V61-1h2] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62-1h1] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62-1h2] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62-1h3] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V70] 

    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55-1] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55-2] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55-2H4] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55-2HF] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55-2HW] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V60] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V61] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V62] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V70] 
                                    

INSTALLATION INSTRUCTIONS:

1.  Copy the appropriate kit(s) to your system(s)

2.  Read the following information files in the kit(s) copied:
		ALPLIBR05_070.CVRLET_TXT
		ALPLIBR05_070.README
             or
		VAXLIBR05_070.CVRLET_TXT
		VAXLIBR05_070.README

3.  Follow the installation instructions in the README file

4.  NOTE - In order for the corrections in the kit to take effect
    the system must be rebooted.  If the system is a member of
    a VMScluster, the entire cluster should be rebooted.


ADDITIONAL INFORMATION:

Applications and OpenVMS components most likely to experience       
errors are those that pass delta-time arguments with values         
exceeding 9999 days on system-supplied date routines. The most      
likely date that these errors will occur is 19-MAY-1997:00:00,      
which is 10,000 days after the common UNIX time origin of           
1-JAN-1970. The errors take various forms, and affect               
applications that are both non-threaded and multi-threaded.         
(Applications can also encounter errors before the system           
clock reaches 19-MAY-1997 if an application uses future dates       
and specifies a date of 19-MAY-1997 or later.)                      
                                                                              
The versions of OpenVMS that are affected by the 10,000 day         
delta-time restriction are:                                        

o  OpenVMS Alpha Version 6.1 through Version 7.0 (inclusive):

   OpenVMS Alpha V6.1, V6.1-1H1, V6.1-1H2, 
                 V6.2, V6.2-1H1, V6.2-1H2, V6.2-1H3, 
                 V7.0

o  OpenVMS VAX Version 5.5 through Version 7.0 (inclusive):

   OpenVMS VAX V5.5, V5.5-1, V5.5-2, V5.5-2HW, V5.5-2H4, V5.5-2HF,
   OpenVMS VAX V6.0, OpenVMS VAX V6.1, OpenVMS VAX V6.2, 
   OpenVMS VAX V7.0

Systems running OpenVMS VAX Version 7.1 or OpenVMS Alpha Version    
7.1 are not impacted and do not need to install the ECO.

The following OpenVMS components and software products are known to
be affected by the delta-time limit. The ECOs correct the problems
observed in these products.

    OpenVMS SECURITY Server             OpenVMS Alpha V7.0 only

    DECwindows Motif for OpenVMS        OpenVMS Alpha V7.0 only

    Distributed Computing Environment   OpenVMS Alpha V6.2 only
    (DCE) for OpenVMS

    OpenVMS DECthreads                  OpenVMS Alpha and OpenVMS VAX 
                                        V5.5 through V7.0

    (OSU) DECthreads HTTP Server        OpenVMS Alpha and OpenVMS VAX 
    (freeware provided with the         V5.5 through V7.0
    OpenVMS Internet Product Suite)

Other software products running on OpenVMS might also experience
errors stemming from this delta-time limit. Contact the appropriate
software vendor for more information.


CONTACT INFORMATION:

Up-to-date reference information on local Information
Security contacts can be found at the following locations:

    INTERNAL WWW SERVERS
      Corporate Security
        http://corpsec.mso.dec.com/
      Information Services Security
        http://www-is-security.mso.dec.com/
      
    VIDEOTEXT SERVERS
      $ VTX SECURITY


NOTE:

    The only authorized source of computer/network security
advisories and bulletins for Digital is the Corporate
Information Security Group.  Please advise your system
managers and users of Digital's computers and networks that
any security warnings, alerts, advisories, and bulletins,
especially those requiring responsive action on their part,
are the explicit responsibility of the Corporate Information 
Security Group.

    If an internal or external advisory or bulletin is received
from other sources and no information on the topic has been
received from CISG, please contact our group at DTN 223-8900.
This allows a single focus for all security advisory or 
bulletin information for our Company.

All security advisories and bulletins can be found via the
Security Advisory Notefile MINOTR::SECURITY_ADVISORY
(http://www-notes.lkg.dec.com/minotr/security_advisory) or 
VTX SECURITY.

DIGITAL INTERNAL USE ONLY
    
T.RTitleUserPersonal
Name
DateLines
131.1With Corrected Kit LocationsMINOTR::NOBLEYour Data, Your Job...Protect BothFri Mar 14 1997 16:19213
         DIGITAL INTERNAL USE ONLY
************************************************
*        CORPORATE SECURITY
*        CORPORATE INFORMATION SECURITY GROUP
*        Mar 07, 1997
*        SECURITY BULLETIN #1997-02
*
************************************************
[DO NOT DELETE THIS BANNER]


This security bulletin is for immediate distribution to all
OpenVMS/VAX and OpenVMS/AXP system managers, internal support
personnel and any other appropriate internal organizations within
Digital Equipment Corporation.  Cost Center managers hosting
contract personnel are responsible for ensuring appropriate
forwarding of this bulletin.


SUBJECT:  OpenVMS Delta-Time Limit Problem

The OpenVMS operating system has a documented delta-time limit that
may cause a serious error in some applications and OpenVMS
components beginning on or around 19-MAY-1997. DIGITAL has provided
ECOs (Engineering Change Orders) that remove the delta-time limit.


IMPACT:

OpenVMS customers may experience errors in some applications        
and OpenVMS components when dates are specified on or around
19-MAY-1997.

As identified further on, The OpenVMS SECURITY Server is one of the
known components to be affected  by the delta-time limit.  Symptoms
may involve denial-of-service, including system crash.


REQUIRED ACTIONS:

CISG strongly recommends all system managers running OpenVMS/VAX
V5.5 - V7.0, and/or OpenVMS/AXP V6.1 - V7.0 obtain and read the
cover letter and the README file to fully determine the impact to
their system.  System managers who determine or suspect that their
system(s) is impacted, should install the appropriate ECO for the
system(s) version they are running.


SECURITY KIT NAMES:

ECO:  ALPLIBR05_070, for OpenVMS/AXP V6.1 - V7.0
	FILE NAMES:
		ALPLIBR05_070.A-DCX_AXPEXE
		ALPLIBR05_070.B-DCX_AXPEXE
		ALPLIBR05_070.C-DCX_AXPEXE
		ALPLIBR05_070.CHKSUM
		ALPLIBR05_070.CVRLET_TXT
		ALPLIBR05_070.D-DCX_AXPEXE
		ALPLIBR05_070.README

ECO:  VAXLIBR05_070, for OpenVMS/VAX V5.5 - V7.0
	FILE NAMES:
	  	VAXLIBR05_070.A-DCX_VAXEXE
		VAXLIBR05_070.B-DCX_VAXEXE
		VAXLIBR05_070.C-DCX_VAXEXE
		VAXLIBR05_070.CHKSUM
		VAXLIBR05_070.CVRLET_TXT
		VAXLIBR05_070.D-DCX_VAXEXE
		VAXLIBR05_070.E-DCX_VAXEXE
		VAXLIBR05_070.F-DCX_VAXEXE
		VAXLIBR05_070.G-DCX_VAXEXE
		VAXLIBR05_070.README


SECURITY KIT LOCATIONS:

These ECOs are internally available from the following Security
Patch Server location:
        
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V61] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V61_1h1] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V61_1h2] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62_1h1] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62_1h2] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V62_1h3] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.ALPHA.V70] 

    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55_1] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55_2] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55_2H4] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55_2HF] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V55_2HW] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V60] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V61] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V62] 
    ESRSRF""::DISK$ESRSRF_DAT01:[SECURITY.OPENVMS.VAX.V70] 
                                    

INSTALLATION INSTRUCTIONS:

1.  Copy the appropriate kit(s) to your system(s)

2.  Read the following information files in the kit(s) copied:
		ALPLIBR05_070.CVRLET_TXT
		ALPLIBR05_070.README
             or
		VAXLIBR05_070.CVRLET_TXT
		VAXLIBR05_070.README

3.  Follow the installation instructions in the README file

4.  NOTE - In order for the corrections in the kit to take effect
    the system must be rebooted.  If the system is a member of
    a VMScluster, the entire cluster should be rebooted.


ADDITIONAL INFORMATION:

Applications and OpenVMS components most likely to experience       
errors are those that pass delta-time arguments with values         
exceeding 9999 days on system-supplied date routines. The most      
likely date that these errors will occur is 19-MAY-1997:00:00,      
which is 10,000 days after the common UNIX time origin of           
1-JAN-1970. The errors take various forms, and affect               
applications that are both non-threaded and multi-threaded.         
(Applications can also encounter errors before the system           
clock reaches 19-MAY-1997 if an application uses future dates       
and specifies a date of 19-MAY-1997 or later.)                      
                                                                              
The versions of OpenVMS that are affected by the 10,000 day         
delta-time restriction are:                                        

o  OpenVMS Alpha Version 6.1 through Version 7.0 (inclusive):

   OpenVMS Alpha V6.1, V6.1-1H1, V6.1-1H2, 
                 V6.2, V6.2-1H1, V6.2-1H2, V6.2-1H3, 
                 V7.0

o  OpenVMS VAX Version 5.5 through Version 7.0 (inclusive):

   OpenVMS VAX V5.5, V5.5-1, V5.5-2, V5.5-2HW, V5.5-2H4, V5.5-2HF,
   OpenVMS VAX V6.0, OpenVMS VAX V6.1, OpenVMS VAX V6.2, 
   OpenVMS VAX V7.0

Systems running OpenVMS VAX Version 7.1 or OpenVMS Alpha Version    
7.1 are not impacted and do not need to install the ECO.

The following OpenVMS components and software products are known to
be affected by the delta-time limit. The ECOs correct the problems
observed in these products.

    OpenVMS SECURITY Server             OpenVMS Alpha V7.0 only

    DECwindows Motif for OpenVMS        OpenVMS Alpha V7.0 only

    Distributed Computing Environment   OpenVMS Alpha V6.2 only
    (DCE) for OpenVMS

    OpenVMS DECthreads                  OpenVMS Alpha and OpenVMS VAX 
                                        V5.5 through V7.0

    (OSU) DECthreads HTTP Server        OpenVMS Alpha and OpenVMS VAX 
    (freeware provided with the         V5.5 through V7.0
    OpenVMS Internet Product Suite)

Other software products running on OpenVMS might also experience
errors stemming from this delta-time limit. Contact the appropriate
software vendor for more information.


CONTACT INFORMATION:

Up-to-date reference information on local Information
Security contacts can be found at the following locations:

    INTERNAL WWW SERVERS
      Corporate Security
        http://corpsec.mso.dec.com/
      Information Services Security
        http://www-is-security.mso.dec.com/
      
    VIDEOTEXT SERVERS
      $ VTX SECURITY


NOTE:

    The only authorized source of computer/network security
advisories and bulletins for Digital is the Corporate
Information Security Group.  Please advise your system
managers and users of Digital's computers and networks that
any security warnings, alerts, advisories, and bulletins,
especially those requiring responsive action on their part,
are the explicit responsibility of the Corporate Information 
Security Group.

    If an internal or external advisory or bulletin is received
from other sources and no information on the topic has been
received from CISG, please contact our group at DTN 223-8900.
This allows a single focus for all security advisory or 
bulletin information for our Company.

All security advisories and bulletins can be found via the
Security Advisory Notefile MINOTR::SECURITY_ADVISORY
(http://www-notes.lkg.dec.com/minotr/security_advisory) or 
VTX SECURITY.

DIGITAL INTERNAL USE ONLY
    
    
131.3Addendum #1 Supersedes Original BulletinMINOTR::NOBLEYour Data, Your Job...Protect BothTue May 13 1997 15:02207
         DIGITAL INTERNAL USE ONLY
************************************************
*        CORPORATE SECURITY
*        CORPORATE INFORMATION SECURITY GROUP
*        May 12, 1997
*        SECURITY BULLETIN #1997-02, ADDENDUM #1
*
************************************************
[DO NOT DELETE THIS BANNER]


INTENDED AUDIENCE:

This security bulletin is for immediate distribution to all DIGITAL
OpenVMS system managers, internal support personnel and any other
appropriate internal organizations within Digital Equipment
Corporation.  Cost Center managers hosting contract personnel are
responsible for ensuring appropriate forwarding of this bulletin.


SUBJECT:  Addendum to Security Bulletin 1997-02, Delta-Time Limit

This is a reminder that the DIGITAL OpenVMS Delta-Time Limit may
cause system problems on or about 19 May 1997 for OpenVMS/Alpha and
OpenVMDS/VAX Versions V5.0 through V7.0.

CISG Security Bulletin 1997-02/Addendum #1, Delta-Time Limit Problem
for OpenVMS, supersedes Security Bulletin 1997-02.  OpenVMS
Engineering has released additional ECOs to address OpenVMS versions
5.0 through 5.5.  OpenVMS Engineering has also released ECO
VAXLIBR06_070, which supersedes VAXLIBR05_070.  This Addendum is
intended to provide complete, up to date ECO information and to
provide reference pointers to additional detailed information
regarding the Delta-Time Limit problem.


REQUIRED ACTIONS:

CISG strongly recommends all system managers running OpenVMS/VAX
V5.0 - V7.0, and/or OpenVMS/AXP V6.1 - V7.0 obtain and read the
cover letter and the README file to fully determine the impact to
their system.  System managers who determine or suspect that their
system(s) is impacted, should install the appropriate ECO for the
system(s) version they are running.


SECURITY KIT NAMES:

ECO:  ALPLIBR05_070, for OpenVMS/AXP V6.1 - V7.0
        FILE NAMES:
                ALPLIBR05_070.A-DCX_AXPEXE
                ALPLIBR05_070.B-DCX_AXPEXE    
                ALPLIBR05_070.C-DCX_AXPEXE
                ALPLIBR05_070.CHKSUM
                ALPLIBR05_070.CVRLET_TXT
                ALPLIBR05_070.D-DCX_AXPEXE
                ALPLIBR05_070.README

ECO:  VAXLIBR01_050 for OpenVMS/VAX V5.0 - V5.0-2
	FILE NAMES:
		VAXLIBR01_050.A-DCX_VAXEXE
		VAXLIBR01_050.B-DCX_VAXEXE
		VAXLIBR01_050.C-DCX_VAXEXE
		VAXLIBR01_050.CHKSUM
		VAXLIBR01_050.CVRLET_TXT
		VAXLIBR01_050.README

ECO:  VAXLIBR01_051 for OpenVMS/VAX V5.1 - V5.1-1
	FILE NAMES:
		VAXLIBR01_051.A-DCX_VAXEXE
		VAXLIBR01_051.CHKSUM
		VAXLIBR01_051.CVRLET_TXT
		VAXLIBR01_051.README

ECO:  VAXLIBR01_052 for OpenVMS/VAX V5.2 - V5.2-1
	FILE NAMES:
		VAXLIBR01_052.A-DCX_VAXEXE
		VAXLIBR01_052.B-DCX_VAXEXE
		VAXLIBR01_052.C-DCX_VAXEXE
		VAXLIBR01_052.CHKSUM
		VAXLIBR01_052.CVRLET_TXT
		VAXLIBR01_052.README

ECO:  VAXLIBR01_053 for OpenVMS/VAX V5.3 - V5.3-2
	FILE NAMES:
		VAXLIBR01_053.A-DCX_VAXEXE
		VAXLIBR01_053.B-DCX_VAXEXE
		VAXLIBR01_053.C-DCX_VAXEXE
		VAXLIBR01_053.CHKSUM
		VAXLIBR01_053.CVRLET_TXT
		VAXLIBR01_053.README

ECO:  VAXLIBR01_054 for OpenVMS/VAX V5.4 - V5.4-3
	FILE NAMES:
		VAXLIBR01_054.A-DCX_VAXEXE
		VAXLIBR01_054.B-DCX_VAXEXE
		VAXLIBR01_054.C-DCX_VAXEXE
		VAXLIBR01_054.CHKSUM
		VAXLIBR01_054.CVRLET_TXT
		VAXLIBR01_054.README

ECO:  VAXLIBR06_070, for OpenVMS/VAX V5.5 - V7.0
        FILE NAMES:
                VAXLIBR06_070.A-DCX_VAXEXE
                VAXLIBR06_070.B-DCX_VAXEXE
                VAXLIBR06_070.C-DCX_VAXEXE
                VAXLIBR06_070.CHKSUM
                VAXLIBR06_070.CVRLET_TXT
                VAXLIBR06_070.D-DCX_VAXEXE
                VAXLIBR06_070.E-DCX_VAXEXE
                VAXLIBR06_070.F-DCX_VAXEXE
                VAXLIBR06_070.G-DCX_VAXEXE
                VAXLIBR06_070.README
      NOTE: VAXLIBR06_070 supersedes VAXLIBR05_070.  
      See the *.README for details.


SECURITY KIT LOCATIONS:

These ECOs are internally available from the following Security
Patch Server location:

MINOTR::USER7:[SECURITY_KITS.OPENVMS.ALPHA.*]
MINOTR::USER7:[SECURITY_KITS.OPENVMS.VAX.*]

Replace the "*" with the appropriate version - example:
	[SECURITY_KITS.OPENVMS.ALPHA.V61]


INSTALLATION INSTRUCTIONS:

1.  Copy the appropriate kit(s) to your system(s).

2.  Read the appropriate *.CVRLET_TXT and *.README information files
    in the kit(s) copied.

3.  Follow the installation instructions in the *.README file(s).

4.  NOTE - In order for the corrections in the kit to take effect
    the system must be rebooted.  If the system is a member of
    a VMScluster, the entire cluster should be rebooted.


ADDITIONAL INFORMATION:

The following URL provides additional useful information regarding
the OpenVMS Delta-Time Limit problem -
	http://www.openvms.digital.com/openvms/10k/index.html
From this URL you will find additional links to:
o   DIGITAL OpenVMStm Delta-Time Limit Notification Letter 
o   DIGITAL OpenVMStm Delta-Time Limit Letter for PRE VMS 5.5 Users 
o   Guide to the OpenVMS Delta-Time Limit for System Managers
	and Application Providers 
o   Questions and Answers about the Delta-Time Limit ECO 
o   SHOW10K.DCL DCL command procedure to build a MACRO program
	which checks for the ECO's installation 
o   A list of Applications Impacted by the Delta-Time limit 
o   A list of Applications NOT Impacted by the Delta-Time limit 
o   TENSOR a utility that identifies programs that must be relinked 

CONTACT INFORMATION:

Up-to-date reference information on local Information
Security contacts can be found at the following locations:

    INTERNAL WWW SERVERS
      Corporate Security
        http://corpsec.mso.dec.com/
      Information Services Security
        http://www-is-security.mso.dec.com/
      
    VIDEOTEXT SERVERS
      $ VTX SECURITY


NOTE:

    CISG Security Bulletins provide information about 
electronic information security threats and/or issues that
may not require a specific action or response.  A Security
Bulletin is used to communicate a moderate risk which is not
as time sensitive as a CISG  Security Advisory.

    The only authorized source of computer/network security
advisories and bulletins for Digital is the Corporate
Information Security Group.  Please advise your system
managers and users of Digital's computers and networks that
any security warnings, alerts, advisories, and bulletins,
especially those requiring responsive action on their part,
are the explicit responsibility of the Corporate Information 
Security Group.

    If an internal or external advisory or bulletin is received
from other sources and no information on the topic has been
received from CISG, please contact our group at DTN 223-8900.
This allows a single focus for all security advisory or 
bulletin information for our Company.

    All security advisories and bulletins can be found via the 
DIGITAL Corporate Security WEB Site at URL 
http://corpsec.mso.dec.com/ref-info, or the Security Advisory
Notefile at MINOTR::SECURITY_ADVISORY.


DIGITAL INTERNAL USE ONLY

131.4UPDATE for V5.0 through V5.4-3MINOTR::NOBLEYour Data, Your Job...Protect BothThu May 15 1997 19:5354
DESCRIPTION:

The ECOs for the older versions of OpenVMS (V5.0 through V5.4-3) 
replace the existing LIBRT.EXE image with a new LIBRT.EXE.  

IMPACT:

If a system has any customized versions of library routines in 
the LIBRT.EXE image, those modifications will be lost. 

SOLUTION:

This issue is clearly documented in the *.CVRLET_TXT files and 
the Customer Letter publicly available on the WEB at URL
	http://www.openvms.digital.com/openvms/10k/10kpre55.html
However, it was not highlighted in the CISG Security Bulletin 
1997-02 Addendum #1.  

Given the low probability of a user or 3rd party application 
mis-using the Delta-Time function, system managers should be 
sure they will have a problem before installing the ECO for 
their system.  Such problems should be limited to just the 
application in question, and have no overall impact on system 
functions.

If a system manager does install the ECO, and does lose 
customized routines, (s)he will need to restore the old 
LIBRT.EXE image from backup, or re-install the missing 
customized routines.

If a system manager determines that they have an application 
effected by the Delta-Time problem, they must consider one of 
the following actions:
1.  Discontinue use of the application
or,
2.  Modify the application to handle time functions differently
or,
3.  Install the ECO, then re-install customized library routines
or,
4.  Upgrade to at least V5.5, then install the appropriate ECO.


Regards,
Chuck

Security  Communication  Program
Corporate Information Security
Chuck Noble, SCP Program Manager
noble@mail.dec.com
dtn 223-8728
Phone (508) 493-8728
FAX (508) 493-5464
    
131.5VAXeln Patch InformationMINOTR::NOBLEYour Data, Your Job...Protect BothFri May 16 1997 13:15299
    This information was just received.  The following reference
    information is included in the body of the Customer Q&A section:
    
    
    A: The patch will be on the DIGITAL web site at the following address: 

    http://www.digital.com/info/oem/software/vaxeln46-dt-update.zip

    Q: How do I install the update?

    A: The update is shipped in a "zip" file. You must have the VMS version
    of the UNZIP utility installed on your system. For more information,
    see the following web site: 

    http://www.openvms.digital.com/openvms/freeware/cd.html
    
    
    
    CISG has no other information available at this time.  Please contact
    the DIGITAL VAXeln group with further questions -
       	Nancy Fredrickson, 237-2924, fredrickson@mail.dec.com
    
    
    
                                    -<*>-
    
    
    
From:	AESTLS::LPERUSSE "SUPAYwoman  15-May-1997 1659 -0600"
	15-MAY-1997 16:59:46.97

To:	@DSN$DBDATA:DSN$Flash_INTERNAL_RECIPIENT.DIS
CC:	
Subj:	DSNlink Flash for vaxeln
    
     Dear Customer,

     The following is important information about the product VAXELN.

     Thank you,

     Digital Customer Support Center


VAXELN Delta Time Limit Notification Cover Letter

May 1997

Dear VAXELN Customer,

The following is important information concerning a documented delta
time restriction in VAXELN.

The VAXELN operating system has a documented delta time limit that
may cause an error in some applications beginning on or around
19-MAY-1997. DIGITAL has provided an update to VAXELN V4.6 that
addresses some aspects of the delta time limit. 

Applications likely to experience errors are those that pass delta
time arguments with values exceeding 9999 days to system-supplied
date routines. A possible date that these errors will occur is
19-MAY-1997, which is 10000 days after the common UNIX time origin
of 1-JAN-1970. 

The following routines are affected:

	LIB$SUB_TIMES
	LIB$MULT_DELTA_TIME
	LIB$MULTF_DELTA_TIME
	LIB$ADD_TIMES

An update is available for VAXELN V4.6 which removes the restriction
for these routines. Please contact your normal DIGITAL support
channel for further information. 

Routines that use ASCII delta time strings will not be updated. The
following routines accept or return ASCII delta time strings in
which the "Days" field must not exceed 9999 days. 

	ELN$TIME_VALUE
	ELN$TIME_STRING
	TIME_VALUE (EPascal and Ada only)
	TIME_STRING (EPascal and Ada only)
	SYS$BINTIM
	SYS$ASCTIM

The remainder of this article provides detailed answers to questions
you may have concerning this issue. DIGITAL appreciates your
cooperation and patience. We regret any inconvenience applying this
update may cause. 



Q: I've heard that certain VAXELN routines have a documented time
restriction that can cause errors in some applications. Can you tell
me more about this? 

A: Some routines in the VAXELN operating system have a documented
limit of ten thousand (10000) days on delta times. Any software that
uses these routines to process a time interval of 10000 or more days
will encounter run-time errors upon reaching this limit. The date
19-May-1997 is 10,000 days from the UNIX and C base date of
1-Jan-1970. Applications using the routines with the delta time
restrictions in conjunction with the UNIX or C base date may
encounter problems with the conversion of the 19-May-1997 date and
later dates. These dates exceed 10000 days and exceed the documented
four-digit limit of the "Day" field in delta times. Other base dates
will encounter this ten-thousand day limit at other times. DIGITAL
has removed the 10000 day limit in some of the affected routines
with an update to VAXELN V4.6. 

Q: What is a delta time?

A delta time is a time interval. An absolute time is a date. For
example, one second (0000 00:00:01.00) is a delta time and midnight
on May 19, 1997 (19-MAY-1997 00:00:00.00) is an absolute time. On
VAXELN, both are represented internally as a 64 bit count of clock
ticks. The LARGE_INTEGER data structure is provided for use with the
various routines which accept or return an internal time value.
Absolute times are not affected by this restriction. 

Q: Why does the 10000 day limit exist in the first place?

A: It was a design decision made long ago. The format for the ASCII
representation of a delta time was defined to be "dddd hh:mm:ss.cc".
Delta times were never intended to be used for long periods of time.
On VAXELN, the most common use of a delta time is to pass to
ker$wait_any() to specify a short interval on which to delay. 

Q: What are the VAXELN routines that have the 10000 day restriction? 

A: The following routines have been updated to allow the internal
representation of a delta time to exceed 10000 days: 

	LIB$SUB_TIMES
        LIB$MULT_DELTA_TIME
        LIB$MULTF_DELTA_TIME
        LIB$ADD_TIMES

   The following routines will continue to have the restriction:

        ELN$TIME_VALUE
        ELN$TIME_STRING
        TIME_VALUE (EPascal and Ada only)
        TIME_STRING (EPascal and Ada only)
        SYS$BINTIM
        SYS$ASCTIM


Q: Why are some routines updated but not all of them?

A: The routines being updated deal strictly with the 64 bit internal
representation of time. An update is possible to these routines
without changing any data structures visible to user applications
and without causing any undesirable side effects. The routines which
are not being updated convert internal time to an ASCII string and
vice versa. DIGITAL believes that increasing the size of the string
which holds the ASCII representation (to add an extra "Day" digit)
could break more applications than it fixes. The size of the string
will remain unchanged for compatibility reasons. 

Q: What are the symptoms of the problem on systems running VAXELN
V4.6 without this update? 

A: If your application uses any of the routines being updated with a
delta time greater than 9999 days, an appropriate error status is
returned to the application indicating that an error has occurred.
An example of an application which might be affected is one which
attempts to convert the VAXELN representation of the current time
into a number of seconds since January 1, 1970. If it tried to
subtract the absolute time equivalent to January 1, 1970 from any
absolute time after May 19, 1997 (using LIB$SUB_TIMES, for example)
the result will be a delta time greater than 10000 days. An error
status will be returned by LIB$SUB_TIMES. 

Q: For those routines which are not updated, what are the symptoms
of the problem and what can I do about it? 

A: The restriction on the internal time to ASCII conversion routines
is well-documented on VAXELN. When these routines are supplied with
a delta time greater than 9999 days, an exception is raised
indicating the error. If your application uses these routines in
such an unsupported manner, it will have to be modified. This is a
permanent restriction. 

Q: What if my application calls both the routines being updated and
the routines not being updated? 

A: If your application calls any of the routines being updated with
a delta time greater than 9999 days, that call will succeed once the
patch has been applied. If you then pass that delta time to any of
the routines not being updated, it will fail as documented. The 9999
days limit is a permanent restriction for the mentioned time/string
conversion routines. 

Q: Which versions of VAXELN are affected and who needs to install
the update? 

A: Versions of VAXELN starting with V4.3 are affected. The LIB$
routines being updated were new in V4.3. DIGITAL recommends that all
customers running VAXELN V4.6 apply the update. 

Q: What about versions V4.3, V4.4 and V4.5?

A: Only VAXELN V4.6 is currently supported. If you are running a
older version and have not updated for some reason, contact your
local DIGITAL office. 

Q: If my application uses any of the routines being updated, what
changes do I need to make in my code as a result of this update. 

A: None. This update removes a restriction in very specific areas
that previously would have generated an error. 

Q: How will customers be notified?

A: Customers with current support contracts for VAXELN will be
notified that a patch exists for this problem with instructions on
how to obtain it. 

Q: How do customers without support contracts obtain the update?

A: The patch will be on the DIGITAL web site at the following
address: 

    http://www.digital.com/info/oem/software/vaxeln46-dt-update.zip

Q: How do I install the update?

A: The update is shipped in a "zip" file. You must have the VMS
version of the UNZIP utility installed on your system. For more
information, see the following web site: 

    http://www.openvms.digital.com/openvms/freeware/cd.html
    
After you have installed UNZIP, you can extract the files to your
SYS$LOGIN directory like this: 

	$ SET DEF SYS$LOGIN
	$ UNZIP VAXELN46_DT_UPDATE.ZIP

The following files will be extracted to your SY$LOGIN: 

	README.TXT		! this text
	LIBMSC.EXE		! shareable library update
	LIBSUBTIMES.OBJ		! object library update

To apply the update, first save the existing versions of
RTLSHARE.OLB, RTLOBJECT.OLB and LIBMSC.EXE in case you ever want to
revert to the pre-update behavior: 

	$ SET DEF ELN$
	$ COPY RTLSHARE.OLB RTLSHARE.OLB_V46
	$ COPY RTLOBJECT.OLB RTLOBJECT.OLB_V46
	$ COPY LIBMSC.EXE LIBMSC.EXE_V46

Next, apply the patch:

	$ SET DEF ELN$
	$ LIB/REP RTLSHARE SYS$LOGIN:LIBMSC.EXE
	$ COPY SYS$LOGIN:LIBMSC.EXE LIBMSC.EXE
	$ LIB/REP RTLOBJECT SYS$LOGIN:LIBSUBTIMES.OBJ

Q: Does I have to do anything after the update has been applied? 

A: Yes. After the update has been applied, the application must be
linked, the system image must be rebuilt and the target system must
be rebooted. 

Q: Do I ever need to reapply this update once I have applied it? 

A: If you ever choose to re-install VAXELN V4.6, the update needs to
be re-applied. 

Q: How can the System Manager tell if the update has been applied? 

A: LIBMSC.EXE has a unique "image file identification." To find it,
use the following command: 

	$ ANALYZE/IMAGE/INTER ELN$:LIBMSC.EXE

The "image file identification" will be under the "Image
Identification Information" section. The updated image
identification is "VAXELN V4.6-05." 

LIBSUBTIMES.OBJ has a unique module identification. To find it, use
the following command: 

	$ LIB/LIST/FULL ELN$:RTLOBJECT

Look for the module "LIB$DATE_ARITHMETIC." The identification for
the updated version is "X-2." 

Q: Does this update contain any other functional changes or bug
fixes to VAXELN V4.6? 

A: No.