OBSOLETE Patch-ID# 114565-16


Download this patch from My Oracle Support

Your use of the firmware, software and any other materials contained in this update is subject to My Oracle Support Terms of Use, which may be viewed at My Oracle Support.
For further information on patching best practices and resources, please see the following links:
Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.

Keywords: security ftp dos retry connect in.ftpd
Synopsis: Obsoleted by: 114565-17 SunOS 5.9_x86: /usr/sbin/in.ftpd Patch
Date: Dec/06/2010


Install Requirements: Reboot after installing this patch to activate the changes delivered. An alternative may be specified in the Special Install Instructions.
Use Single User Mode (run level S) when installing this patch on an active boot environment. An alternative may be specified in the Special Install Instructions.

Solaris Release: 9_x86

SunOS Release: 5.9_x86

Unbundled Product:

Unbundled Release:

Xref: This patch available for SPARC as patch 114564

Topic: SunOS 5.9_x86: /usr/sbin/in.ftpd Patch

Relevant Architectures: i386

Bugs fixed with this patch:

Sun CR # Bug #
470519215112493
470607215112752
471453415114845
479126415137200
480696015142667
486468715160267
490203215171356
501243615201095
501594815202146
501647815202293
507320315218433
623948715253568
631633715284018
644288215337583
650138815365355
651470015372953
671666815488680
694694515638815
698038515665355


Changes incorporated in this version: 6980385

Patches accumulated and obsoleted by this patch:

Patches which conflict with this patch:

Patches required with this patch:

Obsoleted by:

Files included with this patch:

/usr/sbin/ftpconfig
/usr/sbin/ftpcount
/usr/sbin/ftprestart
/usr/sbin/ftpshut
/usr/sbin/ftpwho
/usr/sbin/in.ftpd
/usr/sbin/privatepw

Problem Description:

6980385 ftpd problems with globbing
 
(from 114565-15)
 
6946945 CVE-2008-4247 ftpd vulnerable to CSRF
 
(from 114565-14)
 
6716668 in.ftpd handles "LIST ." as "ls -lA *", not "ls -lA ."
 
(from 114565-13)
 
6514700 when the FTP server tries to bind one of the extra reserved ports, it gives up
 
(from 114565-12)
 
6501388 pwd subcommand in in.ftpd truncates the first 3 bytes from dirname, if dirname is a symlink
 
(from 114565-11)
 
5073203 guest user cannot chdir to home directory if nscd is running
 
(from 114565-10)
 
6442882 in.ftpd does not support clients that are not fully RFC-959 compliant
 
(from 114565-09)
 
5012436 restricted-uid and restricted-gid restrictions may be bypassed
 
(from 114565-08)
 
6316337 missing ftpconfig deliverable from T114564-07 / T114565-07
 
(from 114565-07)
 
4806960 IP6.ARPA domain should be used for IPv6 address to DNS name mapping
4902032 in.ftpd (wu) bypasses /etc/nsswitch.conf
4791264 deny !nameserved doesn't deny access when it should
5015948 ftpconfig should include libresolv.so.2 in the chroot area
 
(from 114565-06)
 
6239487 in.ftpd has a globbing problem in the wu_fnmatch() function
 
(from 114565-05)
 
6239487 in.ftpd has a globbing problem in the wu_fnmatch() function
 
(from 114565-04)
 
5016478 the limit of NLST(ftp) on Solaris 9 is too small
 
(from 114565-03)
 
4864687 Solaris 9 ftpd slow with PUT
 
(from 114565-02)
 
4706072 buffer size miscalculations in realpath.c
4705192 possible buffer overflow if ftpconversions feature is in use
 
(from 114565-01)
 
4714534 FTP server connect retry DOS vulnerability


Patch Installation Instructions:
--------------------------------
 
Please refer to the man pages for instructions on using 'patchadd'
and 'patchrm' commands provided with Solaris.
 
The following example installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/123456-07
 
The following example removes a patch from a standalone system:
 
       example# patchrm 123456-07
 
For additional examples please see the appropriate man pages. Any
other special or non-generic installation instructions should be
described below as special instructions.


Special Install Instructions:
-----------------------------
 
This patch alters the way the ftp daemon performs name resolution. It now
uses the nsswitch.conf(4) interface instead of using the resolver directly.
This change affects the following:
 
dns resolveroptions
 
This setting was an optional (not included by default) parameter which could be
specified in the /etc/ftpd/ftpaccess(4) file to modify the resolver behavior.
This was done by adding or removing bits in _res.options e.g.
 
dns resolveroptions +aaonly -dnsrch
 
Turns on the aaonly option (only  accept  authoritative answers) and turns
off the dnsrch option (search the domain path).
 
The changes in the ftp daemon no longer use _res.options so the way parameters
are specified changes to be in concordance with that documented in
/etc/resolv.conf(4) e.g.
 
dns resolveroptions rotate attempts:1
 
Turns on querying name servers round-robin and selects querying each name
server only once. This also improves consistency by making the way resolver
options are specified in /etc/ftpd/ftpaccess consistent with /etc/resolv.conf.
 
Installations using resolveroptions in /etc/ftpd/ftpaccess will need to remap
their existing parameters into the style specified in resolv.conf(4).


README -- Last modified date: Thursday, March 28, 2013