OBSOLETE Patch-ID# 126133-04

Download this patch from My Oracle Support

Your use of the firmware, software and any other materials contained in this update is subject to My Oracle Support Terms of Use, which may be viewed at My Oracle Support.

For further information on patching best practices and resources, please see the following links:

Keywords: security ssh sshd kerberos libpam
Synopsis: Obsoleted by: 138060-03 SunOS 5.10: sshd patch
Date: Jun/13/2008

Install Requirements: After installing this patch on an active boot environment, the system will be in a potentially inconsistent state until a reboot is performed. Unless
otherwise specified in the Special Install Instructions below, it is normally safe to apply further patches prior to initiating the reboot due to the relatively small footprint of the patch utilities. Normal operations must not be resumed until after the reboot is performed.
Use Single User Mode (run level S) when installing this patch on an active boot environment. An alternative may be specified in the Special Install Instructions.

Solaris Release: 10

SunOS Release: 5.10

Unbundled Product:

Unbundled Release:

Xref: This patch available for x86 as patch 126134

Topic: SunOS 5.10: sshd patch

Relevant Architectures: sparc

Bugs fixed with this patch:

Sun CR #	Bug #
4950865	15184445
5096250	15225817
5096299	15225836
6203206	15239122
6221783	15246175
6230131	15249725
6319578	15285387
6382076	15311228
6432083	15333058
6460128	15345613
6473333	15351739
6504798	15367145
6509089	15369477
6516612	15373983
6527064	15379925
6552966	15394203
6569824	15403863
6583189	15411289
6684003	15470145

Changes incorporated in this version: 4950865 5096250 5096299 6203206 6221783 6230131 6319578 6382076 6473333 6516612

Patches accumulated and obsoleted by this patch: 127714-03 138066-01

Patches which conflict with this patch:

Patches required with this patch: 120011-14 127127-11 (or greater)

Obsoleted by: 138060-03

Files included with this patch:

/lib/libpam.so.1
/lib/sparcv9/libpam.so.1
/usr/bin/scp
/usr/bin/sftp
/usr/bin/ssh
/usr/bin/ssh-keyscan
/usr/include/security/pam_appl.h
/usr/lib/security/pam_dhkeys.so.1
/usr/lib/security/pam_roles.so.1
/usr/lib/security/pam_unix_account.so.1
/usr/lib/security/pam_unix_cred.so.1
/usr/lib/security/sparcv9/pam_dhkeys.so.1
/usr/lib/security/sparcv9/pam_roles.so.1
/usr/lib/security/sparcv9/pam_unix_account.so.1
/usr/lib/security/sparcv9/pam_unix_cred.so.1
/usr/lib/ssh/sftp-server
/usr/lib/ssh/ssh-http-proxy-connect
/usr/lib/ssh/ssh-keysign
/usr/lib/ssh/ssh-socks5-proxy-connect
/usr/lib/ssh/sshd

Problem Description:

4950865 pam_unix_cred audit code could be cleaner
5096250 pam_unix_account(5) should syslog locked accounts
5096299 application can mask libpam syslog output
6203206 sshd should set PAM_AUSER for hostbased userauth for audited logins to roles
6221783 pam_start changes syslog logmask
6230131 pam_setcred needs to capture major/minor device id for local terminals
6319578 pam_unix_cred.so.1 dumps core due to the use of incorrect buffer length
6382076 gss comment in cmd/ssh/sshd/auth-pam.c is bogus
6473333 implement PSARC/2006/534  remote user audit attribution update
6516612 pam_roles module needs to know about PAM_AUSER
 
(from 126133-03)
 
6504798 ssh fails for users when ngroups_max=32
6684003 fix CVE-2008-1483 in SunSSH
 
(from 126133-02)
 
        This revision accumulates generic Sustaining patch 127714-03
        into Solaris S10U5 Update.
 
(from 126133-01)
 
        This revision accumulates generic Sustaining patch 127714-02
        into Solaris S10U5 Update.
 
(from 127714-03)
 
6527064 sshd uses LC_CTIME instead of LC_TIME
6552966 ssh should issue warning message for expired passwords again
 
(from 127714-02)
 
6460128 sshd changes locale from ISO8859-1 to UTF-8
 
(from 127714-01)
 
6432083 sshd dumps core if /usr/bin/locale missing or gives empty output
6509089 sshd not logging kerberos principals with syslog
 
(from 138066-01)
 
6569824 password reset loops for password changes when owner not allowed to change password aging policy
6583189 pam_get_user(3PAM) can leak memory

Patch Installation Instructions:

--------------------------------
 
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
 
For Solaris 7-10 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
       example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.

Special Install Instructions:

-----------------------------
 
NOTE 1:  Before installing this patch, please be sure to install the
         latest patch utilities patches for your OS. This list of
         patches is defined at - http://sunsolve.sun.com
 
         Please use the pull down list which appears after the text:
         "Latest Patch Update: To ensure the correct functioning of
         the patching utilities on your system, stay up to date on
         the following patches"
 
NOTE 2:  If the patch is being applied to a live system, please stop
         and start SunSSH daemon by doing the following:
 
         # svcadm disable ssh
         # svcadm enable ssh
 
         This way the changes to the SunSSH daemon delivered by this
         patch will take effect immediately. Already established
         connections will not be affected during the restart.

README -- Last modified date: Saturday, November 10, 2012