Patch Name: PHNE_10009 Patch Description: s700_800 10.0X-10.10 cumulative ftp(1) and ftpd(1M) patch Creation Date: 97/01/31 Post Date: 97/02/07 Repost: 97/02/14 The patch documentation was modified to reference an additional Service Request, SR 4701334763. The files included in the patch were not modified. Hardware Platforms - OS Releases: s700: 10.00 10.01 10.10 s800: 10.00 10.01 10.10 Products: N/A Filesets: InternetSrvcs.INETSVCS-RUN InternetSrvcs.INET-ENG-A-MAN Automatic Reboot?: No Status: General Superseded Critical: Yes PHNE_10009: OTHER A timing problem could occur on receipt of a simultaneous data close and ABORT PHNE_6014: OTHER Prevents the ability to do ftp server bounce. Path Name: /hp-ux_patches/s700_800/10.X/PHNE_10009 Symptoms: PHNE_10009: (ftpd) * Privileged ports cannot be specified as a part of the PORT command. * An error message "You've GOT to be joking" is displayed when a client specifies a privileged port as a data-port. * A ftp client could interrupt a data transfer by sending a data close and an ABORT. A timing problem has been observed on the ftpd side. PHNE_9181: (ftpd) * ftpd returns a 550 after an NLST when the file is not found. PHNE_6919: (ftpd) * On trusted systems ftpd ignores /etc/ftpusers. PHNE_6014: (ftpd) * The PORT command would allow connections to 3rd party servers at random ports, and combined with quoted commands, could be used to mask the source IP address of that connection. Defect Description: PHNE_10009: (ftpd) * An option "-p" has been added. The PORT command can now specify a privileged port as a data-port if this option is set. * The error message "You've GOT to be joking" has been replaced by "Port command failure". * ftpd has been fixed to handle a simultaneous data close and ABORT appropriately. PHNE_9181: (ftpd) * ftpd returns a 550 after a NLST when a file is not found. The return code was changed to 450 per RFC 959. PHNE_6919: (ftpd) * The code for trusted systems was not calling the routine to check for entries in /etc/ftpusers. PHNE_6014: (ftpd) * There were no limits on the range of allowable PORTs. Now only ftp-data ports on the system originating the ftp-ctrl connection are accepted, and only non-privileged ports on that system are permitted. SR: 4701346098 5003343970 5003344846 5003322867 4701334763 Patch Files: /usr/bin/ftp /usr/lbin/ftpd /usr/share/man/man1m.Z/ftpd.1m what(1) Output: /usr/bin/ftp: Copyright (c) 1985, 1989 Regents of the University o f California. main.c based on 5.13 (Berkeley) 3/14/89 Revision 1.1.112.1 Mon Feb 3 18:41:18 GMT 1997 cmds.c 5.18 (Berkeley) 4/20/89 cmdtab.c 5.9 (Berkeley) 3/21/89 ftp.c 5.28 (Berkeley) 4/20/89 glob.c 5.7 (Berkeley) 12/14/88 ruserpass.c 5.1 (Berkeley) 3/1/89 domacro.c 1.6 (Berkeley) 2/28/89 /usr/lbin/ftpd: Copyright (c) 1985, 1988 Regents of the University o f California. ftpd.c based on 5.28 (Berkeley) 4/20/89 Revision 1.7.112.3 Wed Feb 5 01:42:19 GMT 1997 ftpcmd.y 5.20 (Berkeley) 2/28/89 glob.c 5.7 (Berkeley) 12/14/88 popen.c 5.7 (Berkeley) 2/14/89 logwtmp.c 5.2 (Berkeley) 9/22/88 /usr/share/man/man1m.Z/ftpd.1m: (none) cksum(1) Output: 943837895 90112 /usr/bin/ftp 3283777691 86016 /usr/lbin/ftpd 1345322897 7428 /usr/share/man/man1m.Z/ftpd.1m Patch Conflicts: None Patch Dependencies: None Hardware Dependencies: None Other Dependencies: None Supersedes: PHNE_6014 PHNE_6919 PHNE_9181 Equivalent Patches: PHNE_10008: s700: 9.01 9.05 9.07 s800: 9.00 9.04 PHNE_10010: s700: 10.20 s800: 10.20 Patch Package Size: 240 Kbytes Installation Instructions: Please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and, limitation of liability and warranties, before installing this patch. ------------------------------------------------------------ 1. Back up your system before installing a patch. 2. Login as root. 3. Copy the patch to the /tmp directory. 4. Move to the /tmp directory and unshar the patch: cd /tmp sh PHNE_10009 5a. For a standalone system, run swinstall to install the patch: swinstall -x autoreboot=true -x match_target=true \ -s /tmp/PHNE_10009.depot 5b. For a homogeneous NFS Diskless cluster run swcluster on the server to install the patch on the server and the clients: swcluster -i -b This will invoke swcluster in the interactive mode and force all clients to be shut down. WARNING: All cluster clients must be shut down prior to the patch installation. Installing the patch while the clients are booted is unsupported and can lead to serious problems. The swcluster command will invoke an swinstall session in which you must specify: alternate root path - default is /export/shared_root/OS_700 source depot path - /tmp/PHNE_10009.depot To complete the installation, select the patch by choosing "Actions -> Match What Target Has" and then "Actions -> Install" from the Menubar. 5c. For a heterogeneous NFS Diskless cluster: - run swinstall on the server as in step 5a to install the patch on the cluster server. - run swcluster on the server as in step 5b to install the patch on the cluster clients. By default swinstall will archive the original software in /var/adm/sw/patch/PHNE_10009. If you do not wish to retain a copy of the original software, you can create an empty file named /var/adm/sw/patch/PATCH_NOSAVE. Warning: If this file exists when a patch is installed, the patch cannot be deinstalled. Please be careful when using this feature. It is recommended that you move the PHNE_10009.text file to /var/adm/sw/patch for future reference. To put this patch on a magnetic tape and install from the tape drive, use the command: dd if=/tmp/PHNE_10009.depot of=/dev/rmt/0m bs=2k Special Installation Instructions: None