Patch-ID# 114880-12

6571384 Device Manager can be spoofed
6512434 DTU hang/choppiness seen when using PCSC and SRWC 1.1_15 with smartcard PKI certs and ActivCard
6592372 channels switch when playing audio on SR2FS and SR2 DTUs
6596045 Audio record not working on 4.0 b48 on Sun Ray 2 family
6573093 1400x1050 res doesn't work if native panel resolution
6610233 Sun Ray firmware problem with 2048bit key
6568443 Oberthur 5.2 cards do not work on Sun Rays
6623818 Firmware load prevented by barrier on new SR270 DTUs
 
(from 114880-11)
 
6519512 Type 7 keyboard/hub freezes/stops working with Sun Ray DTUs
6482250 MTU received through DHCPINFORM request is not taking effect
6489577 null pointer dereference in UpdateArpTable
6499940 Firmware should not do Get Response processing for scbus APDUs
6438243 Mondex MM2 cards are not recognized
6457990 Sometimes SR270, Sun Ray 2 and Sun Ray 2FS  hang when Authenticated Smart Cards are used
6500512 SR2 (P8) DTU fails RDP PIN login when using Starcos SPK 2.3 and 2.4 smart cards
6316937 DTU hangs and power cycles when trying to send data using loopback cables with SR 170 embedded ports
5060424 DTUs not getting configured MTU from LAN Sunray Server
6393502 Sun Ray firmware needs to report smartcard ATR history length as well.
6398942 TCP connections can fail when initialization sequence is irregular
6338019 Sun Ray needs to distinguish between Sun Type 6 Japanese keyboard and other Japanese keyboards
6382740 Sun Ray 170 can get stuck sending exchangeAPDU to certain OpenPlatform-like smartcards, causing 26D
6446288 Mouse pointer "floats" and/or doesn't reach the title bar when in full screen mode on MS windows
6446769 Balance adjustments affect mono speaker volume on 270
6428572 Provide firmware support for new Sun Ray 2,Sun Ray 2fs   Sun Ray 270 units
6482453 Firmware panics on NULL value for redirectProps key
 
(from 114880-10)
 
6319180 utxconfig is insufficently paranoid
6418906 sunray_get_user:isValidUsername logs too much information to syslog - security
6412036 utsettings can fail when run against some Sun Ray 2 firmware builds
4950642 Sun Ray web GUI should reduce volume of logfile output
6457072 Support on Sun Ray for smartcard operations with 2048 bit keys
6421484 Sun Ray smartcard driver masks odd INS bytes
6443568 Some USB 2.0 hubs don't appear to work when attached to Sun Ray
 
(from 114880-09)
 
6242160 Xsun's footprint quickly soars to over 2GB when Cadence on sunray is used and then it crashes
6230062 Sun Ray 170 should support multiple resolutions
6225835 yuv transformation underflows on black pixels
6274105 2.0 patch - utcard for not being able to remove partially configured card.
 
(from 114880-08)
 
6189847 With "pam_sunray.so" in the PAM stack kerberos credential generation fails
6228580 Scroll wheel on Fujitsu PID==0x1001 mouse is not recognised
6212211 SunRay The position of the mouse pointer is random on xinerama displays
6190711 Mouse cursor is lost in Xinerama when video is played in enlarged realplayer
5092486 Mouse pointer tracking is not stable under stress in multihead
 
(from 114880-07)
 
5093304 memorex and targus mice don't work after -04 patch
5093359 SunRay P7 firmware accesses non existent IIC address
5099685 Sun Ray slow session login
5107987 SunRay appliances appears slower if server's switch is using GBE instead FE
5100267 Bring back functionality to turn off "energy star"/monitor power save mode.
4988476 sunray nscm should support bsdmd5 authentication
5098417 NSCM: passwords will be truncated if user login information comes from LDAP
6174975 model info report from SunRay 170 and SunRay 1G is incorrect
5100314 elecom mouse prod=1390.24 scroll wheel fails
5096807 elecom mouse scroll wheel issue
5096276 contour mouse scroll wheel fails on SRSS 3.0 beta
5110323 memory leak in recycling connections that have played audio
5088842 initial support for SunRay 170
5109501 SunRay 170 firmware needs to sense input source button state
5092591 need mechanism to identify SR1G versus SR170
6184036 ls -l prints "columnwise output" when using sunray AND login in w/ Deutsch Euro" 114880-04 and above
5052353 NSCM does not allow usernames   8 characters
5085690 Card communications return incorrect status code when issuing some commands
5089387 PC/SC returns error status code 0x632X instead of 0x63CX
6192217 sunray ddx checks for accelerated copy generate incorrect results
6183230 m800 mouse does not work on SRSS 3.0
6199882 DTU rx buffer management deadlocks if input queue grows too large
5023930 utdevmgrd starts to "runaway' --- creates a high CPU load
6203630 USB printing fails with some USB printers
4976330 security: utaction for lock-on-detach should use -i option
 
(from 114880-06)
 
5063454 Default hardware revision string is "1", but should be "0".
5066288 Debug print doing lines affects graphics performance.
5068631 Dashed lines have performance and correctness problems
5053302 Mouse freezes in multihead operation
5064629 Xsun crashes in cfb32SolidSpansCopy on Sunray 2.0
5069497 logitech MouseMan Plus does not work
5073665 x11perf -dline100 renders incorrectly when window is partially obscured
5076106 Wavelet quantization needs to be tuned to be as visually lossless as possible
5079645 more scroll wheel mouse regressions
5049272 logitech first mouse scroll wheel doesn't work
5066776 Firmware should support SST flash
5039558 Sunmc agent keeps dying on Sun Ray servers
5028900 NSCM login GUI should have maximum number of characters for username
5061144 SRSS2.0; login failure with NSCM and native-LDAP
5063300 excessive .Xauthxxxxx files in /tmp cause NSCM login performance degradation
 
(from 114880-05)
 
5041770 Add support for 1400x1050 resolution for Tadpole Comet
5043539 utaudio cpu consumption is increased 20 fold from patch 2 to 3
5047600 Compression strategy sometimes uses wavelets inappropriately
5048434 Multihead problem with windowpane on non primary monitor.
5049181 X server crashes in newtCachePolyText8
5043517 CAC/JavaBadge cards with usernames longer than 9 characters cannot login
5057683 interrupt transfer descriptors are requeued with incorrect length
5057692 microsoft intellimouse 2.0 wireless tilt scroll wheel combo mouse does not work
5057957 Text rendering through font cache clips entire line at screen edge.
5054679 installation of SR2.0 patch 114880-04 causes 'utgstatus' segmentation fault
5046583 DTU may reset when audiokeys are pressed
5061744 security: screenlock not available on detach after login on TSol
 
(from 114880-04)
 
4775352 Second screen in MH config goes blank on its own
4759966 utdevmgrd: getting double mapping error messages and incorrect $UTDEVROOT link
4960514 Sun Ray 1G needs normal blanking interval 1600x1200 at 60 Hz timing
4979769 rendering issues on SR1G
4980867 Icons don't show up at all on a P7 based SR100
4995913 sunray firmware closes tcp connection unnecessarily
4841245 Random port selections aren't random enough
4842800 utaudio and utxset don't do bw management properly
4847413 Screen update does not occur when flipping screens
4847657 Rasterop lines are drawn twice
4850576 Degenerate multihead breaks and remakes connection when switching screens
4857347 forceInsert porperty is not cleared until the next redirection
4942260 Firmware upgrades fail over high latency, lbw connections
4944875 Need to explicitly request vendor parameters
4945510 utload can't load firmware to Copernicus hardware or to multihead secondaries
4954684 Firmware load icon can display incorrect FW server
4965543 Sun Ray DTUs don't work behind NAT gateways
4967253 DHCP lease renewal algorithm is flawed
4976175 X server crashes in newtPolyFillRect
4997503 long delay between card insertion and PIN loginGUI.
4992396 authd not responding to callback requests
4917981 Add keyboard, mouse, monitor to card reader and you can bypass security policy
4958479 ut_check_name needs to be public
4985620 USB mass storage service needs to know display ID
4997442 device link name generation should be consistent
4994404 server side OSD icons change to 26D after some time
5009497 Scrolling of a textedit window continues after button release
5010353 Crossing screens in degenerate mode can cause the mouse to hang
4849042 Group manager segment violation when too many interfaces are configured
4977771 Load Balancing doesn't work properly in LAN deployment of SRS2.0
5003520 Recursive mutex locking in processing callme causes false deadlock detection
5006545 Loss of network connection is not reported quickly enough
5013715 set boot protocol is missing for some mice devices
5014959 X server font cache disables itself on output disable/reenable
4937735 double ldap_value_free() call in ut_incGeneration()
4838376 cannot issue CLEAR_FEATURE command on USB bulk endpoint
4992187 svclib device struct missing  certain device descriptor fields
4965942 svclib/svcs needs to use unique ut_ naming for register callbacks.
4965958 usblib returns incorrect value for I/O calls when length exceeds MAX_DATA
5010789 Add support for Quatech DSU-100 devices
5016553 X server calls ALP rendering functions from a signal handler
5013617 mouse freezes when dragging windows across multiheads
5012100 scbus library always passes UID=0 to DM
4963980 Need server-side support for 1600x1200@60 VESA timing
5024925 SunRayServer 2.0 failover groups fail
5028734 firmware needs to support short reads for control transfers
 
(from 114880-03)
 
4902617 Provide firmware support for Sunray Plus (P7) models
4958188 tmds pll programming on SR 1g incorrect
4934961 The audio quality from Sunray is quite poor.
4913927 Unable to read ATR on P4 boards.
4889019 Card Recognition fails at times on P4 hardware
4905168 Oberthur cards don't work with on SunRays
4931943 Firmware returns wrong data for some APDUs
4959964 SRCOM library needs to support PC/SC
4959969 scbus library has terminal list race condition
4959976 Update smartcard config file to extract username from CAC
 
(from 114880-02)
 
4878246 off-by-one memory write in library key/value code
4838105 utuser -p  TOKEN  sometimes fails when raw token is JavaBadge
4834790 Firmware returns wrong data for return code 0x63XX during an APDU transaction.
4898094 Freed memory is being referenced later in the code.
4858575 /usr/lib/libc_ut.so library's stat routine seg. faults at NULL file argument
4855375 Load balancing takes too long to even out unbalanced load.
4781321 SunRay Module causes SunMC agent VM to grow
4907215 utinfo::issuePropertiesCallback() should block for connected
4863617 ut_isServerAlive SEGFAULTS if server times out
4877262 GNC vulnerability in non-default session types
4890267 New Quatech SSU-100 devices (PID 0xC020) not working with SunRays
4792984 pam.conf update ignores existing pam entries for dtlogin/dtsession
4881981 Admin library calls use multithread unsafe system calls.
4894276 Sun Ray firmware responds to arbitrary multicast ping
4369691 Firmware info displayed in GUI/CLI for DTU is confusing to user.
 
(from 114880-01)
 
4825808 Javabadge smartcards are sometimes recogonized as OpenPlatform cards.
4841279 utfwadm -N all with no LAN subnets gives bogus errors
4841678 utfwadm -A -a -N all does not work
4840440 postpatch script needs to handle LAN case for utfwadm
4839685 X server drops to lbw limit when packets are lost
4810192 X server rendering cleanup
4841227 Bad processing after lost packet causes bad command interpretation
4839252 SRSS2.0; outline of StarOffice window remains
4433854 Sometimes smartcard removal is not detected and session stays active
4842791 Redirection from server doing encryption to one that's not fails
4825312 CAM/kiosk session does not restart after logout on fast hardware
4817187 Minor mathematical manipulation mitigates multihead mouse mispositioning
4844714 Add DHCP XDM option to specify Sun Ray server list
4842640 Need utility interfaces for lazy auth (sunray_get_user)
4841623 Need a new PAM module to get username infomation
4828674 sunray_get_user.so does not work correctly if stacked multiple times
4813815 username property does not get carried along for redirects to non-trusted hosts
4810962 A forceInsert on redirect should carry forward the redirectProps values
4833004 Determine the home server for a DTU
4836233 Lazy Authentication, authd should push authentication to as late as possible
4838723 Remove the acceptRedirectToken property from auth.props
4874498 Sun/Fujitsu mouse rev(05c/06c) may fail to work in SunRay due to bad packets

-------------------------------- 
For Solaris 2.8 & 9 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
        example# patchadd /var/spool/patch/114880-12
 
The following example removes a patch from a standalone system:
 
        example# patchrm 114880-12
 
For additional examples please see the appropriate man pages.

----------------------------- 
 
NOTE 1: To get the complete fix for 4642695, Solaris 8 users should also install
        the following patch:
 
        108940-46 (or greater)  Motif runtime library patch
 
NOTE 2: (for Trusted Solaris) To get the complete fix for 5061744 (TSOL bug
        5026455), Trusted Solaris 8 HW 12/02 users should also install the
        following patch:
 
        116336-05 (or greater)  dtsession dtlogin patch
 
        Also Trusted Solaris 8 HW 12/02 users should follow the "Post-Login 
        Enhancement for Trusted Solaris" instructions in this README file.
 
NOTE 3: This SRSS patch does not support Live Upgrade.  Please do not install
        this patch via live upgrade.
 
NOTE 4: The DTU firmware delivered in this patch has the following version
        identification string
 
        4.0_127553-01_2007.11.09.17.41
 
NOTE 5: Details on the new OSD icons can be found in the Administration guide.
        http://docs.sun.com/source/820-0411/t-s.html#50429990_81747
 
NOTE 6: Details on the new firmware short cut keys can be found in the
        Administration guide.
 
        Available options are: Stop/Ctrl-Pause A, N, V, Left Arrow, Right Arrow,
                               Down Arrow.
 
        http://docs.sun.com/source/820-0411/new_nw_config.html#50450458_40017
 
NOTE 7: The DTU firmware delivered in this patch has an increased downgrade
        "barrier" of '321' to prevent accidental downgrades to firmware from
        earlier releases.  If you wish to revert a unit back to an earlier
        release of firmware after upgrading to this version of firmware, please
        see the admin guide for information on overriding the
        barrier/barrierLevel mechanism.
 
NOTE 8: Be sure to check that you have the latest SRDS 1.0 patch (117492)
	installed on your system before installing this patch.
 
Warnings & Errors
-----------------
** WARNING: This patch should only be applied to systems which
        have Sun Ray Server Software 2.0 fully installed.  Do not
        attempt to add this patch to the UFS image to be applied as
        part of the install process **
 
** WARNING: Unconfiguring the Sun Ray Server Software before
	removal of this patch may lead to error messages and/or
	removal failure 
 
** WARNING: Login behavior for Non-SmartCard Mobility sessions is
	slightly different, see the following section on LAN Security
	Enhancement.
 
LAN Security Enhancement
------------------------
LAN Security for Non-SmartCard Mobility (NSCM) has been improved, and this
results in a very slightly different user experience when logging in,
which users may wish to be prepared for.  The property
acceptRedirectTokens in /etc/opt/SUNWut/auth.props no longer exists.
Instead, normal login for NSCM now may redirect a user after the
username is entered and before the password-entry screen is presented.
This results in final authentication occurring on the server where the
user's session will be accessed or created.  This has two user-visible
effects, when contrasted to the previous default case where
acceptRedirectTokens=false:
 
	1. Users will never need to enter their username and password
	twice.
 
	2. After entering the username, the NSCM screen will disappear
	and some Sun Ray On Screen Display (OSD) icons will briefly
	appear while the Sun Ray is being redirected to the correct
	server, after which the NSCM screen for "Enter password" will
	appear.  Note that type-ahead will no longer function during
	this interval.  The user must now wait for the password-entry
	screen to be drawn before typing their password.
 
It is hoped that this should not present a significantly different
login experience to users, while providing increased security.
 
 
Post-Login Enhancement for Trusted Solaris
------------------------------------------
 
On Trusted Solaris systems that require the fix for bug 5061744 
(TSOL bug 5026455), besides installing the necessary patches in 
NOTE 4, the administrator should create a file /etc/opt/SUNWut/reaper.conf 
containing the following lines:
 
	REAPER_TIMEOUT=0
	REAPER_DEFER_DISARM=1
 
Please review the file /etc/opt/SUNWut/reaper.conf.template for
additional details.
 
 
Sun Ray Firmware Upgrades
-------------------------
 
This patch includes firmware updates for Sun Ray appliances.  The
updated firmware will be loaded by your Sun Ray appliances through the
usual Sun Ray firmware download mechanism.  The firmware changes are
independent of the Sun Ray Server Software changes but are delivered
in this patch for your convenience.
 
If this patch is being applied to servers configured into a Sun Ray
failover group it must be applied to all servers in the group at your
earliest convenience.  While some members of the group remain unpatched
the restart time of your Sun Ray appliances may be noticeably longer
than usual.  The increased restart time can be avoided by taking the
action described in step 1 below.
 
The following additional steps are required when adding this patch on a
live system:
 
        (before applying patch to system)
 
        1. (optionally) Suppress firmware downloads from all servers in
        a Sun Ray failover group
 
        2. Stop Sun Ray services on the server being patched
 
        (after applying patch)
        3. Reboot the Sun Ray server
 
 
To remove this patch, carry out these steps in the following order:
 
        (before removing the patch)
 
        1. (optionally) Suppress firmware downloads from all servers in
           a Sun Ray failover group
 
        2. Stop Sun Ray services on the server being patched
 
        (after removing the patch)
        3. Reboot the Sun Ray server
 
 
Detailed Steps
--------------
 
1. Suppress firmware downloads
 
        If the server being patched is not a member of a Sun Ray
        failover group you should skip this step.
 
        If the server being patched is a member of a Sun Ray failover
        group then this step is optional but is strongly recommended.
 
        At Patch Installation
        ---------------------
 
            Before adding this patch to servers configured into a Sun
            Ray failover group we advise that you disable Sun Ray
            firmware delivery from all unpatched hosts in the failover
            group.  On each host in the group:
 
                For each of the dedicated network interconnects:
 
                    $ /opt/SUNWut/sbin/utfwadm -a -D -n <intf>
 
                For each of the shared subnetwork interconnects:
 
                    $ /opt/SUNWut/sbin/utfwadm -a -D -N <subnetwork>
 
            Do this only one time, before adding this patch to any
            server in the group.
 
            The purpose of this step is to prevent unpatched servers
            from offering old firmware to Sun Ray appliances that have
            already accepted the new firmware delivered with this
            patch.
 
            If this patch is being applied to a Sun Ray failover group
            then omitting this step may result in increased restart
            times for your Sun Ray appliances.  (A mixture of patched
            and unpatched servers advertising conflicting firmware
            versions may cause the appliance to download new firmware
            each time it restarts.  The appliance automatically
            restarts itself after downloading fresh firmware so its
            overall restart cycle is longer in that case.  The
            appliance may restart itself several times before
            establishing or reconnecting to a session.)  The Sun Ray
            restart time will return to normal once the patch has been
            added to all servers in the failover group.
 
        At Patch Removal
        ----------------
 
            Before removing this patch from servers configured into a
            Sun Ray failover group we advise that you disable firmware
            delivery from any hosts in the failover group that have
            this patch installed.  On each already-patched host in the
            group:
 
                For each of the dedicated network interconnects:
 
                    $ /opt/SUNWut/sbin/utfwadm -a -D -n <intf>
 
                For each of the shared subnetwork interconnects:
 
                    $ /opt/SUNWut/sbin/utfwadm -a -D -N <subnetwork>
 
            Do this only one time, before removing this patch from any
            of the already-patched servers in the group.
 
            The purpose of this step is to prevent already-patched
            servers from offering new firmware to Sun Ray appliances.
 
            If this patch is being removed from a Sun Ray failover group
            then omitting this step may result in increased restart
            times for your Sun Ray appliances.  (A mixture of patched
            and unpatched servers advertising conflicting firmware
            versions may cause the appliance to download new firmware
            each time it restarts.  The appliance automatically
            restarts itself after downloading fresh firmware so its
            overall restart cycle is longer in that case.  The
            appliance may restart itself several times before
            establishing or reconnecting to a session.)  The Sun Ray
            restart time will return to normal once the patch has been
            removed from all servers in the failover group.
 
 
2. Stopping Sun Ray services and login sessions
 
        Before applying this patch to a Sun Ray server or removing this
        patch from a Sun Ray server all users should be logged out of
        their Sun Ray sessions.
 
        Stop the Sun Ray services using the following command:
 
                $ /etc/init.d/utsvc stop
 
        This command will terminate any Sun Ray sessions that were not
        already logged out.
 
        Next, add or remove the patch using the instructions outlined
        above in the section "Patch Installation Instructions".
 
        Adding the patch automatically prepares the server to advertise
        new firmware to your Sun Ray appliances.  Removing the patch
        automatically prepares the server to revert to advertising
        pre-patch firmware to your Sun Ray appliances.
 
 
3. Rebooting the Sun Ray server
 
        The Sun Ray server must be rebooted after the addition or
        removal of the patch.