CA-95:03a.README
Issue date: March 3, 1995

This file is a supplement to CERT advisory CA-95:03a, "Telnet Encryption
Vulnerability" and will be updated as additional information becomes
available.  

This README supersedes CA-95:03.README.

As of March 3, 1995, information from Digital Equipment Corporation and
Sequent Computer Systems has been added to the original text.

Below is information we have received from vendors who have patches available
or upcoming, along with names of vendors who have reported that their
products do not have the problem.

If you have an encrypting Telnet from a vendor who is not listed, please
contact that vendor for information regarding how to get a fixed version.

     Vendor or Source                     Status
     ----------------                     ------------
     Berkeley SW Distribution (BSD)       source-code patch available from
                                          Berkeley; also in Appendix B of 
                                          this advisory
     Data General Corporation             not affected by the vulnerability
     Digital Equipment Corporation	  not affected by the vulnerability
     FTP Software, Inc.                   patch available
     Harris NightHawk System              not affected by the vulnerability
     Hewlett-Packard Company              not affected by the vulnerability
     Nat'l. Center for Supercomputer
       Applications (NCSA)                upgrade available
     Open Software Foundation             not affected by the vulnerability
     The Santa Cruz Operation, Inc.(SCO)  not affected by the vulnerability
     Sequent Computer Systems		  not affected by the vulnerability
     Sun Microsystems, Inc.               not affected by the vulnerability

   
PATCH INFORMATION
-------------
Berkeley Software Distribution (BSD)

     A source-code patch, along with the domestic version of the most
     recently released Telnet sources from Berkeley, are available by
     anonymous FTP from
     
         net-dist.mit.edu:/pub/telnet/telnet.patch
         MD5 65d56befe3d0f1699d38de5509552578

     There is also a PGP ASCII signature file for the patch in
         
          net-dist.mit.edu:/pub/telnet/telnet.patch.sig
          
     This patch can also be found in CERT Advisory CA-95:03a, Appendix B.
     (Note: Do not calculate a checksum for Appendix B alone. It will not
     match the checksum of the FTP version of the patch because the tabs in
     the FTP copy have been replaced with blank spaces in the CA-95:03a
     Appendix B copy.)

-------------
FTP Software, Inc.

     Customers of FTP Software with an encrypting telnet (provided in the
     PC/TCP or OnNet packages) should call the FTP technical support line
     at 1-800-282-4387 and ask for the "tn encrypt patch".

-------------
National Center for Supercomputer Applications (NCSA)

     Users of NCSA Telnet should upgrade to the NCSA Telnet 2.6.1d7, AND
     install the appropriate Kerberos plug-in which are available by
     anonymous FTP from ftp.ncsa.uiuc.edu

     Upgrade

        /Mac/Telnet/Telnet2.6/prerelease/d7/Telnet2.6.1d7(68K).sit.hqx
        MD5  b34b9fda59421b3b83f8df08a83f83b5

        /Mac/Telnet/Telnet2.6/prerelease/d7/Telnet2.6.1d7(fat).sit.hqx
        MD5  877add7c3d298111889fc3f2f272ce6f

     Kerberos plug-ins

	/Mac/Telnet/Telnet2.6/prerelease/AuthMan.plugin.1.0b1.hqx
	MD5  df727eae184b22125f90ef1a31513fd4
        
        /Mac/Telnet/Telnet2.6/prerelease/Kerberos_Telnet_plugin.sit.hqx
        MD5  dbda691efe9038648f234397895c734d

     Questions regarding NCSA Telnet should be directed to
     mactel@ncsa.uiuc.edu



