Patch-ID# 114564-08

NOTE:
***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Keywords: security ftp dos retry connect in.ftpd ftpd
Synopsis: SunOS 5.9: /usr/sbin/in.ftpd Patch
Date: Sep/30/2005


Install Requirements: Install in Single User Mode                      
                      
Solaris Release: 9

SunOS Release: 5.9

Unbundled Product: 

Unbundled Release: 

Xref: This patch available for x86 as patch 114565

Topic: SunOS 5.9: /usr/sbin/in.ftpd Patch

Relevant Architectures: sparc

BugId's fixed with this patch: 4705192 4706072 4714534 4791264 4806960 4864687 4902032 5015948 5016478 6239487 6316337

Changes incorporated in this version: 6316337

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

/usr/sbin/ftpconfig
/usr/sbin/ftpcount
/usr/sbin/ftprestart
/usr/sbin/ftpshut
/usr/sbin/ftpwho
/usr/sbin/in.ftpd
/usr/sbin/privatepw

Problem Description:

6316337 Missing ftpconfig deliverable from T114564-07 / T114565-07
 
(from 114564-07)
 
4806960 IP6.ARPA domain should be used for IPv6 address to DNS name mapping
4902032 in.ftpd (wu) bypasses /etc/nsswitch.conf
4791264 deny !nameserved doesn't deny access when it should
5015948 ftpconfig should include libresolv.so.2 in the chroot area
 
(from 114564-06)
 
6239487 in.ftpd has a globbing problem in the wu_fnmatch() function
 
(from 114564-05)
 
6239487 in.ftpd has a globbing problem in the wu_fnmatch() function
 
(from 114564-04)
 
5016478 The limit of NLST(ftp) on Solaris 9 is too small.
 
(from 114564-03)
 
4864687 Solaris 9 ftpd slow with PUT
 
(from 114564-02)
 
4706072 Buffer size miscalculations in realpath.c
4705192 Possible buffer overflow if ftpconversions feature is in use
 
(from 114564-01)
 
4714534 FTP server connect retry DOS vulnerability

Patch Installation Instructions:
--------------------------------
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
 
For Solaris 7-10 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
       example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.

Special Install Instructions:
-----------------------------
This patch alters the way the ftp daemon performs name resolution. It now
uses the nsswitch.conf(4) interface instead of using the resolver directly.
This change affects the following:
 
dns resolveroptions
 
This setting was an optional (not included by default) parameter which could be
specified in the /etc/ftpd/ftpaccess(4) file to modify the resolver behaviour.
This was done by adding or removing bits in _res.options e.g.
 
dns resolveroptions +aaonly -dnsrch
 
Turns on the aaonly option (only  accept  authoritative answers) and turns
off the dnsrch option (search the domain path).
 
The changes in the ftp daemon no longer use _res.options so the way parameters
are specified changes to be in concordance with that documented in
/etc/resolv.conf(4) e.g.
 
dns resolveroptions rotate attempts:1
 
Turns on querying name servers round-robin and selects querying each name server
only once. This also improves consistency by making the way resolver options are
specified in /etc/ftpd/ftpaccess consistent with /etc/resolv.conf.
 
Installations using resolveroptions in /etc/ftpd/ftpaccess will need to remap
their existing parameters into the style specified in resolv.conf(4)

README -- Last modified date:  Friday, September 30, 2005