<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">Patch-ID# 100840-03
Keywords: mailhost mail security sendmail connect host domain NIS map
Synopsis: Solaris 2.1: Fixes for sendmail
Date: Oct/20/93

Solaris Release: 2.1

SunOS release: 5.1

Unbundled Product:

Unbundled Release:

Topic: Solaris 2.1: Fixes for sendmail

BugId's fixed with this patch: 1101929 1127546 1142888

Changes incorporated in this version: 1142888

Relevant Architectures: sparc

Patches accumulated and obsoleted by this patch:

Patches which conflict with this patch:

Patches required with this patch:

Obsoleted by:

Files included with this patch:


	usr/lib/sendmail
	usr/lib/sendmail.mx
	etc/mail/sendmail.cf
	etc/mail/subsidiary.cf


Problem Description:

1142888 A sendmail security hole dealing with mail delivered to files

This is a serious security hole where SMTP transactions can be used 
to gain access to system files. This is not a duplicate of 1144946,
although the SMTP command sequences are very similar.


(from 100840-02)

1127546:
If sendmail.cf contains the following lines:
	(i.e do custom NIS map lookup)

	DS&lt;any YP map&gt;
	....
	S6
	R$*&lt;@$*$%S&gt;$*           $:$1&lt;@$2${S$3$}&gt;$4

The return result of the lookup will be incorrect.

(from 100840-01)

1101929:
Sendmail sometimes bypasses the mailhost and trys to connect directly to
host outside its domain. (this happens when it finds an entry for the
target host in the host database). The correct behavior is for sendmail
to deliver directly the machine that is in the current domain, and
forward the mail to mailhost for target outside the current domain.



Patch Installation Instructions:
--------------------------------
Generic 'installpatch' and 'backoutpatch' scripts are provided
within each patch package with instructions appended to this section.
Other specific or unique installation instructions may also be
necessary and should be described below.

Special Install Instructions:
----------------------------- 

reboot system after patch installation



Instructions to install patch using "installpatch"
--------------------------------------------------

1.  Become super-user.

2.  Apply the patch by typing:

	&lt;dir&gt;/&lt;patch-id&gt;/installpatch &lt;dir&gt;/&lt;patch-id&gt;

    where &lt;dir&gt; is the directory containing the patch and &lt;patch-id&gt;
    is the patch number.  &lt;dir&gt; must be a full path name.

    Example:

	# /tmp/123456-01/installpatch /tmp/123456-01

3.  If any errors are reported, see "Patch Installation Errors" in
    the Command Descriptions section below.

    Rebooting the system or restarting the application after a successful
    patch installation is usually necessary to utilize patch.

    NOTE: On client server machines the patch package is NOT applied
	  to existing clients or to the client root template space.  
	  Therefore, when appropriate, ALL CLIENT MACHINES WILL NEED 
	  THE PATCH APPLIED DIRECTLY USING THIS SAME INSTALLPATCH 
	  METHOD ON THE CLIENT.  See the next section for instructions
	  for installing a patch on a client.


Instructions for installing a patch on a diskless or dataless client
--------------------------------------------------------------------

1.  Before applying the patch, the following command must be executed
    on the server to give the client read-only, root access to the
    exported /usr file system so that the client can execute the
    pkgadd command:

    share -F nfs -o ro,anon=0 /export/exec/Solaris_2.1_sparc.all/usr

    The command:

    share -F nfs -o ro,root=&lt;client_name&gt; \
		/export/exec/Solaris_2.1_sparc.all/usr

    accomplishes the same goal, but only gives root access to the
    client specified in the command.

2.  Login to the client system and become super-user.

3.  Continue with step 2 in the "Instructions to install patch using
    installpatch" section above.


Instructions for backing out patch using "backoutpatch"
-------------------------------------------------------

1.  Become super-user. 

2.  Change directory to /var/sadm/patch:
 
        cd /var/sadm/patch
 
3.  Backout patch by typing:
 
        &lt;patch-id&gt;/backoutpatch &lt;patch-id&gt;
 
    where &lt;patch-id&gt; is the patch number.

    Example:

	# 123456-01/backoutpatch 123456-01

4.  If any errors are reported, see "Patch Backout Errors" in 
    the Command Descriptions section below.


Instructions for identifying patches installed on system:
----------------------------------------------------------

Type:

    installpatch -p

This command produces a list of the patch IDs of the patches that
are currently applied to the system.  When executed with the -p
option, the installpatch command does not modify the system in
any way.


Command Descriptions
--------------------

NAME

     installpatch - apply patch package to Solaris 2.x system
     backoutpatch - remove patch package from Solaris 2.x system

SYNOPSIS

     installpatch [-u] [-d] &lt;patch directory&gt;
     backoutpatch &lt;patch-id&gt;

DESCRIPTION

     These installation and backout utilities apply only to
     Solaris 2.x associated patches. They do not apply to Solaris
     1.x associated patches. These utilities are currently only
     provided with each patch package and are not included with
     the standard Solaris 2.x release software.

OPTIONS

    installpatch

	-u  unconditional install, do not verify file attributes

	-d  do not save original files being replaced

	-p  print a list of the patches currently applied on the system

DIAGNOSTICS

    Patch Installation Errors:
    --------------------------

    Error message: Patch has already been applied.

      Explanation and recommended action: This patch has already been
	applied to the system.  If the patch has to be reapplied
	for some reason, backout the patch and then reapply it.

    Error message: This patch is obsoleted by a patch which has
	already been applied to this system.  Application of this
	patch would leave the system in an inconsistent state.
	Patch installation is aborted.

      Explanation and recommended action: Occasionally, a patch
	is replaced by a new patch which incorporates the bug fixes
	in the old patch and supplies additional fixes also.  At
	this time, the earlier patch is no longer made available
	to users.  The second patch is said to "obsolete" the
	first patch.  However, it is possible that some users
	may still have the earlier patch and try to apply it to
	a system on which the later patch is already applied.
	If the obsoleted patch were allowed to be applied, the
	additional fixes supplied by the later patch would no
	longer be available, and the system would be left in an
	inconsistent state.  This error message indicates that
	the user attempted to install an obsoleted patch.  There
	is no need to apply this patch because the later patch
	has already supplied the fix.

    Error message: The packages to be patched are not installed on
	this system.

      Explanation and recommended action:  None of the packages
	to be updated by this patch are installed on the system.
	Therefore, this patch cannot be applied to the system.

    Error message: This patch is not applicable to client systems.

      Explanation and recommended action: The patch is only
	applicable to servers and standalone machines.  Attempting
	to apply this patch to a client system will have no effect on
	the system.

    Error message: The /usr/sbin/pkgadd command is not executable.

      Explanation and recommended action:   The /usr/sbin/pkgadd
	command cannot be executed.  The most likely cause of this
	is that installpatch is being run on a diskless or dataless
	client and the /usr file system was not exported with
	root access to the client.  See the section above on
	"Instructions for installing a patch on a diskless or
	dataless client".

    Error message: Patch directory is not of expected format.

      Explanation and recommended action: The patch directory
	supplied as an argument to installpatch did not contain
	any patch packages.  Verify that the argument supplied
	to installpatch is correct. 

    Error message: The following validation errors were found:
	           &lt;validation error(s)&gt;

      Explanation and recommended action: Before applying the patch,
	the patch application script verifies that the current
	versions of the files to be patched have the expected
	fcs checksums and attributes.  If a file to be patched has
	been modified by the user, the user is notified of this
	fact.  The user then has the opportunity to save the
	file and make a similar change to the patched version.
	For example, if the user has modified /etc/inet/inetd.conf
	and /etc/inet/inetd.conf is to be replaced by the patch,
	the user can save the locally modified /etc/inet/inetd.conf
	file and make the same modification to the new file
	after the patch is applied.  After the user has noted all
	validation errors and taken the appropriate action for
	each one, the user should re-run installpatch using
	the "-u" (for "unconditional") option. This time, the
	patch installation will ignore validation errors and
	install the patch anyway.

    Error message:  Insufficient space in /var/sadm to save old files.

      Explanation and recommended action:  There is insufficient
        space in the /var/sadm directory to save old files. 
	The user has two options for handling this problem: 
	(1) generate additional disk space by deleting unneeded
	files, or (2) override the saving of the old files by
	using the "-d" (do not save) option when running installpatch.
	However if the user elects not to save the old versions of
	the files to be patched, backoutpatch CANNOT be used.

	One way to regain space on a system is to remove the
	save area for previously applied patches.  Once the user
	has decided that it is unlikely that a patch will be
	backed out, the user can remove the files that were saved
	by installpatch.  The following commands should be executed
	to remove the saved files for patch xxxxxx-yy:

	cd /var/sadm/patch/xxxxxx-yy
	rm -r save/*
	rm .oldfilessaved

	After these commands have been executed, patch xxxxxx-yy can
	no longer be backed out.

    Error message:  Save of old files failed.

      Explanation and recommended action:  Before applying the patch,
	the patch installation script uses cpio to save the old
	versions of the files to be patched.  This error message
	means that the cpio failed.  The output of the cpio
	would have been preceded this message.  The user should
	take the appropriate action to correct the cpio failure.
	A common reason for failure will be insufficient disk
	space to save the old versions of the files.  The user
	has two options for handling insufficient disk space:
        (1) generate additional disk space by deleting unneeded
        files, or (2) override the saving of the old files by
        using the "-d" option when running installpatch. However
        if the user elects not to save the old versions of the
        files to be patched, the patch CANNOT be backed out.

    Error message: Pkgadd of &lt;pkgname&gt; package failed.  See
	       /tmp/log.&lt;patchnum&gt; for reason for failure.

      Explanation and recommended action:  The installation of one of
	patch packages failed.  Any previously installed packages
	in the patch should have been removed.  See the log file
	for the reason for failure.  Correct the problem and
	re-apply the patch.

    Error message: error while adding patch to root template

      Explanation and recommended action:  The install script
	determined this system to be a client server.  The attempt 
	to apply the patch package to the appropriate root
	template space located under /export/root/templates
	failed unexpectedly.  Check the log file for any failure
	messages.  Correct the problem and re-apply the patch.


    Patch Backout Errors:
    ---------------------

    Error message:  Patch &lt;patchnum&gt; has not been applied to this system.

      Explanation and recommended action:  The user has attempted to back
	out a patch that was never applied to this system.  It is
	possible that the patch was applied, but that the patch
	directory /var/sadm/patch/&lt;patchnum&gt; was deleted somehow.
	If this is the case, the patch cannot be backed out.  The
	user may have to restore the original files from the
	initial installation CD.

    Error message:  Patch &lt;patchnum&gt; was installed without backing up the 
		original files.  It cannot be backed out.

      Explanation and recommended action:  Either the -d option of
	installpatch was set when the patch was applied, or the save
	area of the patch was deleted to regain space.  As a result, the
	original files are not saved and backoutpatch cannot be used.  The 
	original files can only be recovered from the original 
	installation CD.

    Error message: Pkgrm of &lt;pkgname&gt; package failed.  See
	       /var/sadm/patch/&lt;patchnum&gt;/log for reason for failure.

      Explanation and recommended action:  The removal of one of
	patch packages failed.  See the log file
	for the reason for failure.  Correct the problem and
	run the backout script again.

    Error message:  Restore of old files failed.

      Explanation and recommended action:  The backout script uses the
	cpio command to restore the previous versions of the files
	that were patched.  The output of the cpio command should
	have preceded this message.  The user should take the
	appropriate action to correct the cpio failure.

KNOWN PROBLEMS:

     On client server machines the patch package is NOT applied
     to existing clients or to the client root template space.
     Therefore, when appropriate, ALL CLIENT MACHINES WILL NEED
     THE PATCH APPLIED DIRECTLY USING THIS SAME INSTALLPATCH
     METHOD ON THE CLIENT.  See instructions above for
     applying patches to a client.
 
     After a patch package has been installed pkginfo(1) will
     not recognize the SUNW_PATCHID macro in the patch package
     pkginfo file.  Instead, to identify patches installed on
     the system use the grep command method described in the
     patch README.

     The pkgadd command shipped with Solaris 2.1 fails (drops core
     without any error message) when there are more than 100
     entries in the /etc/mnttab file.  This means that installpatch
     can fail, because it uses pkgadd.  Since this is very likely on
     any big system with lots of automounts, ANY patch could fail.
     Applying patch 100901-01 fixes this problem (the README for 
     patch 100901 mentions shutting down the automounter while 
     applying it).

SEE ALSO
     pkgadd(1), pkgchk(1), pkgrm(1), pkginfo(1)
</pre></body></html>