Patch-ID# 114565-10

NOTE:
***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Keywords: security ftp dos retry connect in.ftpd
Synopsis: SunOS 5.9_x86: /usr/sbin/in.ftpd Patch
Date: Nov/20/2006


Install Requirements: Install in Single User Mode                      
                      
Solaris Release: 9_x86

SunOS Release: 5.9_x86

Unbundled Product: 

Unbundled Release: 

Xref: This patch available for SPARC as patch 114564

Topic: SunOS 5.9_x86: /usr/sbin/in.ftpd Patch

Relevant Architectures: i386

BugId's fixed with this patch: 4705192 4706072 4714534 4791264 4806960 4864687 4902032 5012436 5015948 5016478 6239487 6316337 6442882

Changes incorporated in this version: 6442882

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

/usr/sbin/ftpconfig
/usr/sbin/ftpcount
/usr/sbin/ftprestart
/usr/sbin/ftpshut
/usr/sbin/ftpwho
/usr/sbin/in.ftpd
/usr/sbin/privatepw

Problem Description:

6442882 in.ftpd does not support clients that are not fully RFC-959 compliant
 
(from 114565-09)
 
5012436 restricted-uid and restricted-gid restrictions may be bypassed
 
(from 114565-08)
 
6316337 missing ftpconfig deliverable from T114564-07 / T114565-07
 
(from 114565-07)
 
4806960 IP6.ARPA domain should be used for IPv6 address to DNS name mapping
4902032 in.ftpd (wu) bypasses /etc/nsswitch.conf
4791264 deny !nameserved doesn't deny access when it should
5015948 ftpconfig should include libresolv.so.2 in the chroot area
 
(from 114565-06)
 
6239487 in.ftpd has a globbing problem in the wu_fnmatch() function
 
(from 114565-05)
 
6239487 in.ftpd has a globbing problem in the wu_fnmatch() function
 
(from 114565-04)
 
5016478 the limit of NLST(ftp) on Solaris 9 is too small
 
(from 114565-03)
 
4864687 Solaris 9 ftpd slow with PUT
 
(from 114565-02)
 
4706072 buffer size miscalculations in realpath.c
4705192 possible buffer overflow if ftpconversions feature is in use
 
(from 114565-01)
 
4714534 FTP server connect retry DOS vulnerability

Patch Installation Instructions:
--------------------------------
 
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
 
For Solaris 7-10 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
       example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.

Special Install Instructions:
-----------------------------
 
This patch alters the way the ftp daemon performs name resolution. It now
uses the nsswitch.conf(4) interface instead of using the resolver directly.
This change affects the following:
 
dns resolveroptions
 
This setting was an optional (not included by default) parameter which could be
specified in the /etc/ftpd/ftpaccess(4) file to modify the resolver behavior.
This was done by adding or removing bits in _res.options e.g.
 
dns resolveroptions +aaonly -dnsrch
 
Turns on the aaonly option (only  accept  authoritative answers) and turns
off the dnsrch option (search the domain path).
 
The changes in the ftp daemon no longer use _res.options so the way parameters
are specified changes to be in concordance with that documented in
/etc/resolv.conf(4) e.g.
 
dns resolveroptions rotate attempts:1
 
Turns on querying name servers round-robin and selects querying each name
server only once. This also improves consistency by making the way resolver
options are specified in /etc/ftpd/ftpaccess consistent with /etc/resolv.conf.
 
Installations using resolveroptions in /etc/ftpd/ftpaccess will need to remap
their existing parameters into the style specified in resolv.conf(4).

README -- Last modified date:  Monday, November 20, 2006