OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Any Critical Path N-Plex vulnerabilities ?
From: Juan M. Courcoul (courcoulCAMPUS.QRO.ITESM.MX)
Date: Wed Jul 05 2000 - 10:46:22 CDT

As of late, the higher-ups at the place I work decided it was time to
centralize our e-mail setup, eliminating some 30-odd mail servers and
centralizing everything on 6 distribution centers. For that, Critical
Path's (formerly IsoCor) N-Plex WebExpress messaging product was chosen,
to run on IBM RS/6000 AIX 4.3 and a couple of Sun Solaris 7 machines.
Naturally, when the dust settled, it boiled down to the fact that I would
have to take care of one of the servers, on AIX to boot !

Having lurked in this and other Security Focus lists for the past 8
months, I haven't seen any advisories or warnings regarding N-Plex. Is
this due to:

a) The product is ultra-secure, as the maker would like us to believe ?
b) The product is so new that very little is known as of yet ?
c) The product just didn't catch on and represents a minuscule market
   share ?

Any comments, tips or other input would be greatly appreciated. Naturally,
any input on additional vulnerabilities due to the interaction between
N-Plex and the operating system would be most welcome. (Note that I'm not
overly fond of AIX, to say the least).

J. Courcoul courcoulcampus.qro.itesm.mx