Patch-ID# 110323-02 Keywords: security ypbind buffer overflow blank SPACE+CR Synopsis: SunOS 5.8_x86: /usr/lib/netsvc/yp/ypbind patch Date: Sep/24/2002 Install Requirements: None Solaris Release: 8_x86 SunOS Release: 5.8_x86 Unbundled Product: Unbundled Release: Xref: This patch available for SPARC as patch 110322 Topic: SunOS 5.8_x86: /usr/lib/netsvc/yp/ypbind patch Relevant Architectures: i386 BugId's fixed with this patch: 4362647 4515621 Changes incorporated in this version: 4515621 Patches accumulated and obsoleted by this patch: Patches which conflict with this patch: Patches required with this patch: Obsoleted by: Files included with this patch: /usr/lib/netsvc/yp/ypbind Problem Description: 4515621 ypbind incorrectly parses /etc/hosts if SPACE+CR blank line exists (from 110323-01) 4362647 ypbind has a remotely exploitable buffer overflow allowing root privileges Patch Installation Instructions: -------------------------------- For Solaris 2.0-2.6 releases, refer to the Install.info file and/or the README within the patch for instructions on using the generic 'installpatch' and 'backoutpatch' scripts provided with each patch. For Solaris 7-9 releases, refer to the man pages for instructions on using 'patchadd' and 'patchrm' scripts provided with Solaris. Any other special or non-generic installation instructions should be described below as special instructions. The following example installs a patch to a standalone machine: example# patchadd /var/spool/patch/104945-02 The following example removes a patch from a standalone system: example# patchrm 104945-02 For additional examples please see the appropriate man pages. Special Install Instructions: ----------------------------- None. README -- Last modified date: Tuesday, September 24, 2002