OBSOLETE Patch-ID# 123324-03


Download this patch from My Oracle Support

Your use of the firmware, software and any other materials contained in this update is subject to My Oracle Support Terms of Use, which may be viewed at My Oracle Support.
For further information on patching best practices and resources, please see the following links:
Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.

Keywords: security sshd bsm spurious audit syslog ssh banner quiet scp
Synopsis: Obsoleted by: 120011-14 SunOS 5.10: sshd patch
Date: Jun/20/2007


Install Requirements: NA

Solaris Release: 10

SunOS Release: 5.10

Unbundled Product:

Unbundled Release:

Xref: This patch available for x86 as patch 123325

Topic: SunOS 5.10: sshd patch

Relevant Architectures: sparc

Bugs fixed with this patch:

Sun CR # Bug #
637680015308843
645049015340901
645074915341051
645309015342104
645341015342279
646027415345699
646604815348405
647237715351314
647772015353718


Changes incorporated in this version: 6472377 6477720

Patches accumulated and obsoleted by this patch: 124442-01 125430-01

Patches which conflict with this patch:

Patches required with this patch: 118833-36 (or greater)

Obsoleted by: 120011-14

Files included with this patch:

/lib/libbsm.so.1
/lib/sparcv9/libbsm.so.1
/usr/bin/scp
/usr/bin/sftp
/usr/bin/ssh
/usr/bin/ssh-add
/usr/bin/ssh-keyscan
/usr/include/bsm/adt.h
/usr/lib/ssh/ssh-keysign
/usr/lib/ssh/sshd

Problem Description:

6472377 use of system() can cause execution of arbitrary code through malformed filenames (CVE-2006-0225)
6477720 possible DoS in CRC compensation attack detector for SSH protocol 1
 
(from 123324-02)
 
6450749 the +group audit policy is ignored by most userland audit records
6453090 audit_syslog can cause auditd to SEGV when processing unusual filenames
6453410 libbsm:flagstohex() should check the return value of cacheauclassnam()
 
(from 123324-01)
 
6376800 sshd(1M) on BSM enabled systems can trigger spurious audit-related syslog messages
 
(from 124442-01)
 
6450490 ssh prints banner even when in quiet mode
 
(from 125430-01)
 
6460274 scp fails sometimes if target filesystem is ZFS
6466048 scp should not call write() for the last chunk of data twice


Patch Installation Instructions:
--------------------------------
 
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
 
For Solaris 7-10 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
       example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.


Special Install Instructions:
-----------------------------
 
NOTE 1: If you're planning to set up Zones on this system, please make
        sure to install the following patch which fixes bugid 6216195
        (zone installation confused by UPDATE=yes in pkginfo(4) file):
 
        119015-01 (or greater)  Install and Patch Utilities Patch
 
        (Note that 119254 has superseded 119015; installation of the
         current version is recommended to be preferred, due to its
         central role in the installation and removal of patches.)


README -- Last modified date: Saturday, November 10, 2012