OBSOLETE Patch-ID# 125197-06
Download this patch from My Oracle Support
|
Your use of the firmware, software and any other materials contained
in this update is subject to My Oracle Support Terms of Use, which
may be viewed at My Oracle Support.
|
|
For further information on patching best practices and resources, please
see the following links:
|
|
Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
|
Keywords: security international encryption sunwcry softtoken ipsec n2cp niagra2 kcf crypto
Synopsis: Obsoleted by: 127112-05 SunOS 5.10_x86: SUNWcry patch
Date: Nov/01/2007
******************************************************************
The items made available through this website are subject to
United States export laws and may be subject to export and
import laws of other countries. You agree to strictly comply
with all such laws and obtain licenses to export, re-export,
or import as may be required.
Unless expressly authorized by the United States Government
to do so you will not, directly or indirectly, export or
re-export the items made available through this website, nor
direct the items therefrom, to any embargoed or restricted
country identified in the United States export laws, including
but not limited to the Export Administration Regulations
(15 C.F.R. Parts 730-774).
IMPORT INFORMATION: This software contains encryption features
with symmetric key lengths greater than 128-bit, that may be
restricted for import into some countries.
******************************************************************
Install Requirements: After installing this patch on an active boot environment, the system will be in a potentially inconsistent state until a reconfigure reboot is performed. Unless otherwise specified in the Special Install Instructions below, it is normally safe to apply further patches prior to initiating the reboot due to the relatively small footprint of the patch utilities. Normal operations must not be resumed until after the reconfigure reboot is performed.
Use Single User Mode (run level S) when installing this patch on an active boot environment. An alternative may be specified in the Special Install Instructions.
Solaris Release: 10_x86
SunOS Release: 5.10_x86
Unbundled Product:
Unbundled Release:
Xref: this patch available for sparc as patch 125196
Topic: SunOS 5.10_x86: SUNWcry patch
EXPORT INFORMATION: This software contains encryption features
and requires export approval from the U.S. Department of State,
prior to exporting from the United States.
Relevant Architectures: i386
Bugs fixed with this patch:
Changes incorporated in this version: 6452822 6473274 6494834 6534615 6542759 6578997
Patches accumulated and obsoleted by this patch: 118563-14 121291-03 127746-01
Patches which conflict with this patch:
Patches required with this patch: 118855-36 118919-21 120012-14 (or greater)
Obsoleted by: 127112-05
Files included with this patch:
/kernel/crypto/aes256
/kernel/crypto/amd64/aes256
/kernel/crypto/amd64/arcfour
/kernel/crypto/amd64/arcfour2048
/kernel/crypto/amd64/blowfish448
/kernel/crypto/amd64/sha2
/kernel/crypto/arcfour
/kernel/crypto/arcfour2048
/kernel/crypto/blowfish448
/kernel/crypto/sha2
/kernel/drv/amd64/crypto
/kernel/drv/amd64/kssl
/kernel/drv/crypto
/kernel/drv/kssl
/kernel/kmdb/amd64/crypto
/kernel/kmdb/crypto
/kernel/misc/amd64/kcf
/kernel/misc/amd64/sha2
/kernel/misc/kcf
/kernel/misc/sha2
/usr/lib/libelfsign.so.1
/usr/lib/mdb/kvm/amd64/crypto.so
/usr/lib/mdb/kvm/crypto.so
/usr/lib/security/amd64/pkcs11_kernel.so.1
/usr/lib/security/amd64/pkcs11_softtoken.so.1
/usr/lib/security/amd64/pkcs11_softtoken_extra.so.1
/usr/lib/security/pkcs11_kernel.so.1
/usr/lib/security/pkcs11_softtoken.so.1
/usr/lib/security/pkcs11_softtoken_extra.so.1
/usr/sfw/lib/amd64/libcrypto_extra.so.0.9.7
/usr/sfw/lib/amd64/libssl_extra.so.0.9.7
/usr/sfw/lib/libcrypto_extra.so.0.9.7
/usr/sfw/lib/libssl_extra.so.0.9.7
Problem Description:
6452822 C_GenerateKeyPair failed to support CKM_RSA_PKCS_KEY_PAIR_GEN mechanism in dprov mode
6473274 pkcs11_kernel should support multipart ops even for hardware that has only single part
6494834 support check for threshold when using hardware providers even for multi-part requests
6534615 for extra credit, dprov could make HMAC mechanisms work for PKCS #11 clients
6542759 HMAC mechanisms broken in sha2 kernel module
6578997 KSSL should use hardware acceleration for ssl3 macs when available
(from 125197-05)
6458639 kernel aes always advertises CRYPTO_UNLIMITED
(from 125197-04)
6466370 security vulnerabilities in OpenSSL may lead to DoS or code execution
(CVE-2006-3738,CVE-2006-4343)
6467218 fix RSA signature forgery (CVE-2006-4339)
6476279 multiple vulnerabilities in OpenSSL (CVE-2006-2937, CVE-2006-2940)
6476772 update OpenSSL version string with information about security patches included
6483054 OpenSSL lacks Thread Support
(from 125197-03)
6188861 provide libmd - message digest library
(from 125197-02)
6286167 SSLException thrown when using Solaris PKCS provider
(from 125197-01)
6242993 crypto operations on zero byte input data should set output len correctly
6292874 memory leak in asn1_to_*_pri()
6464106 contexts and key schedules might not be cleared all the time
(from 121291-03)
6372587 pkcs11_softtoken should use getpwuid_r(3C) to avoid overwriting thread-specific data
6372169 blowfish can read past mblk and panic in cbc mode
6368332 libpkcs11 should report that it is v2.20 not v2.11
(from 121291-02)
4721729 Support AES Counter mode for encryption
(from 121291-01)
4920408 PKCS#11 v2.20 support for the Crypto Framework
(from 118563-14)
6458639 kernel aes always advertises CRYPTO_UNLIMITED
(from 118563-13)
6466370 Security vulnerabilities in OpenSSL may lead to DoS or code execution
(CVE-2006-3738,CVE-2006-4343)
6467218 fix RSA signature forgery (CVE-2006-4339)
6476279 multiple vulnerabilities in OpenSSL (CVE-2006-2937, CVE-2006-2940)
6476772 update OpenSSL version string with information about security patches included
6483054 OpenSSL lacks Thread Support
(from 118563-12)
6286167 SSLException thrown when using Solaris PKCS provider
(from 118563-11)
6271754 pkcs11_softtoken too aggresive in looking for token data files
(from 118563-10)
6458258 patch 118563 should contain bug fix for 6363872
6363872 AES counter mode increments wrong counter bits on i386
(from 118563-09)
Respun to remove extra files.
(from 118563-08)
Added files that were not needed for this patch.
(from 118563-07)
This revision accumulates s10u2 feature point patch 121291-03.
(from 118563-06)
6276483 libpkcs11 pthread_atfork() code can cause child process to hang
6345493 fork(2) handling fixes from 6276483 needs further work in pkcs11_softtoken
(from 118563-05)
6264344 remove gratuitous bzero() calls from SHA1Final() and MD5Final()
(from 118563-04)
6262344 Metaslot crashes in call to C_UnwrapKey during generation
6252894 BER routines in LDAP library don't work for 64 bit
(from 118563-03)
6222467 system calls from C_Initialize() get interrupted
6195428 "Slot Info is NULL for vca0" error when running SUNvts vcatest on E15K
6211857 driver panics when kcf_free_context() is called
(from 118563-02)
4926742 CKM_DH_PKCS_DERIVE fails if derived secret is shorter than prime
6215816 C_FindObjectsInit fails when token isn't present
6220814 C_DigestKey failure causes C_DestroyObject being hung
(from 118563-01)
4691624 libpkcs11: uCF meta slot management
6199119 pk11object test program core dump with metaslot+pkcs11_kernel+Deimos configured
6215509 fix for 4691624 introduced a lock violation
(from 127746-01)
6568352 IPsec performance does not scale using hardware crypto providers
6594889 Hardware provider flow control broken by CR 6568352
Patch Installation Instructions:
--------------------------------
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
For Solaris 7-10 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions. The following example
installs a patch to a standalone machine:
example# patchadd /var/spool/patch/104945-02
The following example removes a patch from a standalone system:
example# patchrm 104945-02
For additional examples please see the appropriate man pages.
Special Install Instructions:
-----------------------------
NOTE 1: Reboot system after patch installation is complete.
NOTE 2: Before installing this patch, please be sure to install the
latest patch utilities patches for your OS. This list of patches
is defined at - http://sunsolve.sun.com
Please use the pull down list which appears after the text:
"Latest Patch Update: To ensure the correct functioning of the
patching utilities on your system, stay up to date on the
following patches"
NOTE 3: This patch only applies to systems with the Solaris Data Encryption
Kit packages (SUNWcry/SUNWcryr) installed.
NOTE 4: To obtain the complete support for algorithm optimization for crypto
and kernel modules for restricted and non-restricted key lengths
version, please also install the following patch:
118919-11 (or greater) Solaris Crypto Framework patch
NOTE 5: To get the complete fix for the MARS RFE, please also install the
following patch:
118919-12 (or greater) Solaris Crypto Framework patch
README -- Last modified date: Saturday, November 10, 2012