VSI just released a DCL patch.
All architectures. All versions (read: all VSI versions). Rating 1.
"addresses mismanagement of the stack in some DCL processing which
may cause the process to crash"
Sounds like something everyone should install.
On 2026-03-04, Arne Vajh|+j <arne@vajhoej.dk> wrote:VSI is already pushing it.
VSI just released a DCL patch.
All architectures. All versions (read: all VSI versions). Rating 1.
"addresses mismanagement of the stack in some DCL processing which
may cause the process to crash"
Sounds like something everyone should install.
Hmmm. A P1 for a mere process crasher without additional side effects
doesn't sound right.
The first crasher I found in DCL (a few months before the CVE issue) was
also just a benign process crasher (I stuffed structured binary junk into
the recall history buffer) and that certainly didn't qualify as a P1.
I would recommend people ask VSI if this is actually something that
can be made to be an outright vulnerability. _If_ it is, VSI really,
really, need to update this description to draw attention to this and
to also issue a CVE.
On 2026-03-04, Arne Vajh|+j <arne@vajhoej.dk> wrote:
VSI just released a DCL patch.
All architectures. All versions (read: all VSI versions). Rating 1.
"addresses mismanagement of the stack in some DCL processing which
may cause the process to crash"
Sounds like something everyone should install.
Hmmm. A P1 for a mere process crasher without additional side effects
doesn't sound right.
The first crasher I found in DCL (a few months before the CVE issue) was
also just a benign process crasher (I stuffed structured binary junk into
the recall history buffer) and that certainly didn't qualify as a P1.
I would recommend people ask VSI if this is actually something that
can be made to be an outright vulnerability. _If_ it is, VSI really,
really, need to update this description to draw attention to this and
to also issue a CVE.
The last CVE they have listed is still the CVE I am responsible for:
https://vmssoftware.com/about/cves/
_IF_ this is a vulnerability, then the kind of language used in that CVE description is also the same kind of language that needs to be used here.
Simon Clubley <clubley@remove_me.eisner.decus.org-earth.ufp> wrote:
I would recommend people ask VSI if this is actually something that
can be made to be an outright vulnerability. _If_ it is, VSI really,
really, need to update this description to draw attention to this and
to also issue a CVE.
_IF_ this is a vulnerability, then the kind of language used in that CVE
description is also the same kind of language that needs to be used here.
Deciding if this is vulnerability or not may be tricky and I VSI
may prefer to spend resources on fixing this. IIUC CVE is issued
when there is some plausible way to exploit it. AFAIK several things
first deemed impossible to exploit turned out to be vulnerabilities.
So P1 looks reasonable and if there are no known exploit then not
issuing CVE is reasonable too.
To put it differently, "mere process crasher" is IMO rather rare.
Usualy it is potential vulnerability.
On 3/5/2026 8:25 AM, Simon Clubley wrote:
On 2026-03-04, Arne Vajh|+j <arne@vajhoej.dk> wrote:VSI is already pushing it.
VSI just released a DCL patch.
All architectures. All versions (read: all VSI versions). Rating 1.
"addresses mismanagement of the stack in some DCL processing which
may cause the process to crash"
Sounds like something everyone should install.
Hmmm. A P1 for a mere process crasher without additional side effects
doesn't sound right.
The first crasher I found in DCL (a few months before the CVE issue) was
also just a benign process crasher (I stuffed structured binary junk into
the recall history buffer) and that certainly didn't qualify as a P1.
I would recommend people ask VSI if this is actually something that
can be made to be an outright vulnerability. _If_ it is, VSI really,
really, need to update this description to draw attention to this and
to also issue a CVE.
Prominent (literally red!) notice on client portal.
Direct email to customers.
On 3/5/26 7:41 AM, Arne Vajh|+j wrote:
VSI is already pushing it.
Prominent (literally red!) notice on client portal.
Direct email to customers.
No e-mail from VSI here recently, other than the "we know you're all
worried about Rdb" notice.
-a Also nothing in red on the service portal that I can see (the DCL packages are noted in green just like any other "recently released packages").
On 3/5/2026 6:25 PM, Craig A. Berry wrote:
Also nothing in red on the service portal
that I can see (the DCL packages are noted in green just like any other
"recently released packages").
When I log into the client portal I see:
* left menu with download, forum etc.
* main "News/events" with 4 visible items each with a little
-a picture and some text
* between the "New/events" header and the 4 visible items I see
-a a red note
It looks different for you?
On 3/5/26 6:23 PM, Arne Vajh|+j wrote:
On 3/5/2026 6:25 PM, Craig A. Berry wrote:
Also nothing in red on the service portal
that I can see (the DCL packages are noted in green just like any other
"recently released packages").
When I log into the client portal I see:
* left menu with download, forum etc.
* main "News/events" with 4 visible items each with a little
-a-a picture and some text
* between the "New/events" header and the 4 visible items I see
-a-a a red note
It looks different for you?
Hmm.-a I didn't know about the "client portal."-a I have always gone
directly either to the Service Platform (sp.vmssoftware.com) which I mistakenly called the service _portal_ above, or to the forum (forum.vmssoftware.com).-a These now share an authentication mechanism
but otherwise seem to be different web sites running different software.
Now that I know it exists, I can log into client-portal.vmssoftware.com
and see news and product updates on the dashboard.-a The DCL kit is
mentioned under March product updates, but you have to drill down to
find out it's INSTALL_1.-a There is no red note anywhere on the page.
Hmm.-a I didn't know about the "client portal."-a I have always gone
directly either to the Service Platform (sp.vmssoftware.com) which I mistakenly called the service _portal_ above, or to the forum (forum.vmssoftware.com).-a These now share an authentication mechanism
but otherwise seem to be different web sites running different software.
Now that I know it exists, I can log into client-portal.vmssoftware.com
and see news and product updates on the dashboard.
On 3/5/2026 9:47 AM, Waldek Hebisch wrote:
Simon Clubley <clubley@remove_me.eisner.decus.org-earth.ufp> wrote:
I would recommend people ask VSI if this is actually something that
can be made to be an outright vulnerability. _If_ it is, VSI really,
really, need to update this description to draw attention to this and
to also issue a CVE.
_IF_ this is a vulnerability, then the kind of language used in that CVE >>> description is also the same kind of language that needs to be used
here.
Deciding if this is vulnerability or not may be tricky and I VSI
may prefer to spend resources on fixing this.-a IIUC CVE is issued
when there is some plausible way to exploit it.-a AFAIK several things
first deemed impossible to exploit turned out to be vulnerabilities.
So P1 looks reasonable and if there are no known exploit then not
issuing CVE is reasonable too.
To put it differently, "mere process crasher" is IMO rather rare.
Usualy it is potential vulnerability.
Yes.
Everything related to DCL and data in P1 space above the start
of the user mode stack is sensitive, because it is privileged
stuff.
I think the bottom line is: PATCH NOW!
Arne
On 3/5/2026 8:57 AM, Arne Vajh|+j wrote:
Everything related to DCL and data in P1 space above the start
of the user mode stack is sensitive, because it is privileged
stuff.
I think the bottom line is: PATCH NOW!
I assume that there is not a patch for all platforms, all versions?
What are the names of the files that are affected?
| Sysop: | Amessyroom |
|---|---|
| Location: | Fayetteville, NC |
| Users: | 65 |
| Nodes: | 6 (0 / 6) |
| Uptime: | 00:58:47 |
| Calls: | 862 |
| Files: | 1,311 |
| D/L today: |
10 files (20,373K bytes) |
| Messages: | 264,187 |