OBSOLETE Patch-ID# 112908-11
Keywords: security gl_kmech_krb5 kerberos krb5 passwd nfs mapped mech_krb5.so.1
Synopsis: Obsoleted by: 112908-13 SunOS 5.9: krb5 shared object Patch
Date: Nov/06/2003


***************************************************************

Patch 112908-11 has been re-instated on 6/11/04.
Patch 112908-12 was withdrawn.

Reason:
If the machine is configured as a kerberos client with patch 112908-12 
installed and any service is using pam_krb5 as an authentication
module with the `debug` flag passed to pam_krb5, passwords of users doing
authentication will be logged in clear text at LOG_DEBUG level.

Further information can be found by looking at the following BugId(s):
5004688, 4995543

Recommendation:
The following action should be taken if this patch is installed on your system:
o Do not pass the debug flag to pam_krb5
o backout 112908-12
o Disable logging of LOG_DEBUG level messages by editing /etc/syslog.conf

***************************************************************

Install Requirements: Install in Single User Mode                      
                      Reboot immediately after patch is installed                      
                      
Solaris Release: 9

SunOS Release: 5.9

Unbundled Product: 

Unbundled Release: 

Xref: This patch available for x86 as patch 113990

Topic: SunOS 5.9: krb5 shared object Patch
	***********************************************************
	NOTE: This patch may contain one or more OEM-specific platform ports.
	      See the appropriate OEM_NOTES file within the patch for
	      information specific to these platforms.
	      DO NOT INSTALL this patch on an OEM system if a corresponding
	      OEM_NOTES file is not present (or is present, but instructs not
	      to install the patch), unless the OEM vendor directs otherwise.
	***********************************************************

Relevant Architectures: sparc sparc.sun4u

BugId's fixed with this patch: 4197937 4220042 4521000 4526202 4630574 4642879 4657596 4666887 4671577 4690212 4691352 4727224 4743181 4744280 4830044 4836676 4847827 4882946

Changes incorporated in this version: 4882946

Patches accumulated and obsoleted by this patch: 112726-03

Patches which conflict with this patch: 

Patches required with this patch: 112907-01 or greater

Obsoleted by: 

Files included with this patch: 

/kernel/misc/kgss/gl_kmech_krb5
/kernel/misc/kgss/sparcv9/gl_kmech_krb5
/platform/sun4u/kernel/misc/kgss/gl_kmech_krb5
/platform/sun4u/kernel/misc/kgss/sparcv9/gl_kmech_krb5
/usr/lib/gss/gl/abi/abi_mech_krb5.so.1
/usr/lib/gss/gl/abi/sparcv9/abi_mech_krb5.so.1
/usr/lib/gss/gl/mech_krb5.so.1
/usr/lib/gss/gl/sparcv9/mech_krb5.so.1
/usr/lib/security/pam_krb5.so.1
/usr/lib/security/sparcv9/pam_krb5.so.1

Problem Description:

4882946 GSS_C_NO_BUFFER: gss_init_sec_context gives an Error code
 
(from 112908-10)
 
4836676 Bounds checks not in place for princs in krbv5
 
(from 112908-09)
 
4847827 Kerberos patch 112908-07 Error verifying TGT with host, Bad encryption type
 
(from 112908-08)
 
4830044 pam_krb5 needs to be repository aware
 
(from 112908-07)
 
4630574 pam_krb5 should not reimplement utility functions and use libpam utilities
4743181 gss/kerberos frees a buffer returned to caller
 
(from 112908-06)
 
4727224 user application hangs at rpc_gss_seccreate()
4744280 gss_display_status() always returning error
 
(from 112908-05)
 
4526202 pam_krb5 auth can fail with multiple ftp sessions of same user
 
(from 112908-04)
 
4521000 krb5_gss_wrap_size_limit() does not work
4671577 mech_krb5.so should expose krb5_c_verify_checksum function
4691352 Multiple Kerberos vulnerabilities need to be fixed
 
(from 112908-03)
 
4666887 decrypt_as_reply can cause SEGV when request is NULL.
 
(from 112908-02)
 
4657596 passwd aging fix does not work for passwords greater than 8 characters.
4690212 krb5/gss nfs users all getting mapped to user nobody
 
(from 112908-01)
 
        This patch revision was generated to accumulate and obsolete
        the changes introduced in Solaris Update: s9u1
        feature point patches:  112726-03
 
(from 112726-03)
 
        This patch revision was generated to fix the Stab table problem
        occurred in the previous revision.
 
(from 112726-02)
 
        This patch revision was generated to synchronize the
        package version string between s9 and s9u1
 
(from 112726-01)
 
4642879 Kerberos Mechanism Re-sync with MIT 1.2.1
4197937 gss_init_sec_context() doesn't set GSS_C_TRANS_FLAG
4220042 "kadmin: add_principal -expire "9/1/1999 7:00am" xhu"  doesn't work

Patch Installation Instructions:
--------------------------------
 
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
 
For Solaris 7-9 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
       example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.

Special Install Instructions:
-----------------------------
 
NOTE 1:  To get the complete Kerberos feature, please install the following
        patches:
 
        112907-01       (or newer)      libggs
        112921-01       (or newer)      adm5
        112908-01       (or newer)      mech_krb5.so.1
        112922-01       (or newer)      krb5 lib
        112923-01       (or newer)      usr lib krb
        112924-01       (or newer)      usr sbin krb
        112925-01       (or newer)      util admin
 
NOTE 2: To get the complete fix of bug 4836676 "Bounds checks not
         in place for princs in krbv5" please install the following patches:
 
        112925-03 (or newer) kdb5_util
        112923-03 (or newer) krb5kdc
        112921-02 (or newer) libkadm5srv.so.1
        112908-10 (or newer) mech_krb5.so.1 gl_kmech_krb5 pam_krb5.so.1
				(this patch)

README -- Last modified date:  Tuesday, June 15, 2004

