OBSOLETE Patch-ID# 105755-08
Keywords: security libresolv multithreaded in.named res_mkquery
Synopsis: Obsoleted by: 105755-10 SunOS 5.6: libresolv, in.named, named-xfer, nslookup, nstest patch
Date: Apr/19/2000

Solaris Release: 2.6

SunOS Release: 5.6

Unbundled Product: 

Unbundled Release: 

Xref: This patch available for x86 as patch 105756

Topic: SunOS 5.6: libresolv, in.named, named-xfer, nslookup, nstest patch

Relevant Architectures: sparc

BugId's fixed with this patch: 1266187 4056997 4068577 4071167 4089702 4118596 4127017 4127028 4133340 4133571 4134616 4168525 4252453

Changes incorporated in this version: 4252453

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

/usr/lib/libresolv.so.1
/usr/lib/libresolv.so.2
/usr/sbin/in.named
/usr/sbin/named-xfer
/usr/sbin/nslookup
/usr/sbin/nstest

Problem Description:

4252453 libresolv doesn''t handle SIG-records
(from 105755-07)
4134616 in.named can hang when calling res_mkquery
4168525 libresolv fails if cname contains a ''/'' character (rfc 2317)
(from 105755-06)
4133571 BIND has /tmp vulnerabilities
4127028 BIND does not properly bounds check memory references in server and resolver
4127017 Inverse Query in BIND can crash system or give root access to an attacker
4068577 libresolv.so.2 buffer overflow vulnerability per SNI-12 bulletin
(from 105755-05)
4133340 res_send can hang in recvfrom after bogus select/poll return
(from 105755-04)
4118596 in.named stops responding to users requests and uses up CPU
(from 105755-03)
4056997 BIND spoofing vulnerability per SNI-12 bulletin. Also CERT CA-97.22
1266187 function declaration in netdb.h wrong for non-ansi for 4.9.3
(from 105755-02)
4089702 Hostname with underscore, ''_'',  not supported in Solaris 2.6
(from 105755-01)
4071167 libresolv.so.1 can cause threaded applications to deadlock 
        via nss_dns.so.1

Patch Installation Instructions:
-------------------------------- 
Refer to the Install.info file within the patch for instructions on
using the generic ''installpatch'' and ''backoutpatch'' scripts provided
with each patch.  Any other special or non-generic installation
instructions should be described below.

Special Install Instructions:
----------------------------- 
None.

README -- Last modified date:  Monday, April 30, 2001

