Problems Fixed in UnixWare 7.1.3 Update Pack 4

Update Pack 4 (uw713up4) contains all the fixes from Maintenance Pack 1 (uw713mp1), Maintenance Pack 2 (uw713mp2), Maintenance Pack 3 (uw713mp2), Update Pack 1 (uw713up1), Update Pack 2 (uw713up2), and Update Pack 3 (uw713up3), plus additional fixes. See the lists below. The identifiers at the end of each description are SCO escalation and problem report numbers.

Problems fixed in Maintenance Pack 1
Problems fixed in Update Pack 1
Problems fixed in Maintenance Pack 2
Problems fixed in Update Pack 2
Problems fixed in Update Pack 3
Problems fixed in Update Pack 4
Problems Fixed in Update Pack 2 Supplemental Packages
Problems Fixed in Update Pack 3 Supplemental Packages
Problems Fixed in Update Pack 4 Supplemental Packages

Problems fixed in Maintenance Pack 1

uw713mp1 contained the following fixes:

  1. Prevents system panics previously caused when fusers examines an exiting process.
    fz526462

  2. Prevents hangs seen on Compaq ML350 and ML370 Systems when hyperthreading (Jackson Technology) is enabled, i.e., when the boot parameter ENABLE_JT is set to YES.
    fz526444

  3. Fixed problems with the CDE desktop help viewer.
    fz526501

  4. Provides missing scoadmin filesystem files that were not installed when upgrading from UnixWare 7.1.1 or Open UNIX 8.0.0.
    fz526550

  5. Provides updated /usr/include files that were not installed when upgrading from UnixWare 7.1.1 or Open UNIX 8.0.0.
    fz526552

  6. Provides a new makewhatis(1M) command that was not installed when upgrading from UnixWare 7.1.1 or Open UNIX 8.0.0.
    fz526526

  7. Fixed crash(1M) to recognize changes to the callout structure.
    fz518517

  8. Fixes issues target disk driver error recovery.
    fz520729

Problems fixed in Update Pack 1

uw713up1 contains all the fixes listed above for uw713mp1, plus the following additional fixes. Fixes listed with (MP2) at the beginning of the description are also included in Maintgenance Pack 2 (MP2); see Problems fixed in Maintenance Pack 2.

Security Fixes

  1. (MP2) Closing file descriptors 0, 1 and/or 2 before exec'ing a setuid program can make this program open files under these file descriptors, which have special meanings for libc (stdin/stdout/stderr). Reading or writing to root-owned files can be made possible, since stdin/stdout/stderr==opened_file.
    erg712059/fz526562/CSSA-2002-SCO.43

  2. (MP2) A rogue talk client is able to cause the talk demon to overrun a buffer, and could be able to compromise a machine running talkd.
    erg712055/fz521053/CSSA-2002-SCO.42

  3. (MP2) Buffer overflow in XPR portion of libnsl library.
    erg712182/fz526861/CSSA-2003-SCO.7

  4. (MP2) A command line buffer overflow in ps command can be exploited.
    erg712109/fz525292/CSSA-2003-SCO.1

  5. (MP2) The implementation of xdr_array can be tricked into writing beyond the buffers it allocated when deserializing the XDR stream.
    erg501642/fz525725/CSSA-2003-SCO.7

  6. (MP2) Fixed a security vulnerability in the sendmail binary that can be exploited by remote users to gain root access.
    fz527484/erg712247/CSSA-2003-SCO.5

  7. (MP2) When using ftp to transfer a file with a pipe as the first character in its name (for example, |xyz), ftp executes the file on client machine.
    erg712227/fz527425/CSSA-2003-SCO.3

Networking Fixes

  1. (MP2) Panic in PPP driver - pppwsrv() - due to a race condition.
    erg501673/fz526330

  2. (MP2) Panic in PPP's pcid driver.
    erg501650/fz525867

  3. (MP2) Communication problem between pcid and ppp driver.
    erg501678/fz526352

  4. (MP2) The ttymon process sometimes stops listening to a port after PPP disconnect.
    erg501634/fz525626

  5. (MP2) When receiving data from a TCP socket it may lock up indefinitely with data buffered up in the kernel but never returned to the process.
    erg501604/fz520887

  6. (MP2) Connection server fails with the following error:

    10/24/02 17:14:51; 27209; cs: ioctl() set signal error; errno=22

    erg712153/fz526540

  7. (MP2) Improved network printing performance.
    erg712041/fz520932

  8. (MP2) If an ftp client host was reset (as in cycling the power) during the data transmission to the server, the ftp-data connection never times out on the server. If the client tries to use again the same port after reboot for an ftp transmission, the server responds with EADDRINUSE.
    erg501703/fz526973

  9. (MP2) After removing a network interface, pkgchk nics complains about missing files.
    erg712152/fz526505

  10. (MP2) Repeated logins on virtual terminals (/dev/vt02 ... /dev/vt08) result in file descriptor leakage in ttymon.
    erg501636/fz525650

  11. (MP2) When excessive short-lived rlogin sessions are being created, /var/adm/wtmp and /var/adm/wtmpx get out of sync and must be rewritten. While these files are being rewritten, no one can rlogin to the system. If these files grow quite large, this can take up to 20-30 minutes. Also under heavy load the short-lived rlogin sessions may leave in utmp the entries from sessions that have actually completed.
    fz526496/erg712151

  12. (MP2) Can't write to /dev/_tcp/num tty device (rlogin connection).
    erg712250/fz526110

  13. (MP2) Occasionally bind() returns EADDRINUSE for no apparent reason.
    erg712209/fz527217

  14. (MP2) Fixed tape driver bug relating to SAN attached tape drives.
    erg712195/fz526396

  15. (MP2) Fixed an NFS panic which can occur following certain types of transmission errors.
    fz526648

  16. (MP2) Cleaned up code which handles dispatching of tcp timers.
    fz526796

  17. (MP2) Panic in tcp_close.
    fz527439/erg712230

  18. The function write(2) erroneously returns EISCONN on a raw socket.
    erg501681 fz526404

  19. Fixed an NFS hang which can occur when mounting an NFS file system.
    fz526665

  20. Unplugged network cable causes terrible interactive console performance.
    fz520663

  21. System panic while running LSV inet stress tests (GetService).
    fz526345

  22. The utility cs(1Mbnu) fails to include the phone number.
    erg501670, fz526315

  23. PPP stability and scalability improvements.
    fz527328

Miscellaneous Fixes

  1. (MP2) Multi-threaded application may hang in an unkillable sleep, during exec.
    erg712172 fz526750

  2. (MP2) Fix for sdiadd -n panic on systems with a pre-DDI8 Host Bus Adapter (HBA). The problem was that sdi_hot_add() was not converting the older style SCSI address into the newer extended SCSI addressing scheme properly. The original fix set the address to -1's instead of 0's for the wildcard case. pdi_hot will set the SCSI address to all -1's to tell SDI that we want to scan the entire SCSI bus starting from absolute address 0/0/0/0 (controller/bus/target/lun).
    erg712223 fz527360

  3. (MP2) Added minor command modifications required by The Open Group for UNIX95 certification. For details, see UNIX95 Conformance.
    fz526395/fz526629/fz527377

  4. (MP2) The emergency_disk(1M) boot media hangs on system with more than 4 GB RAM.
    fz527578

  5. (MP2) Added undocumented option noquota to the vxfs mount command to fix the problem where the output of mount -p when used in /etc/vfstab, is rejected by mount with the message:

    
    UX:vxfs mount: ERROR: illegal -o suboption -- noquota
    
    
    erg712190 fz526894
  6. (MP2) The kernel can panic in mod_dev_load if a DDI8 driver does not get configured properly.
    fz526791

  7. (MP2) Repeated logins on virtual terminals (/dev/vt02 ... /dev/vt08) result in file descriptor leakage in ttymon.
    erg501636 fz525650

  8. System hangs due to multiple, racing calls to stropen.
    erg501706 fz527158

  9. lint(1) previously warned about _nanf() and nanf() in math.h. Adding a /*LINTED*/ line in front of each suppresses this noise.
    fz527588

  10. The utility cs(1Mbnu) exits unexpectedly due to fork(2) failure.
    erg501710 fz527253

  11. The emergency_rec(1M) command doesn't ignore commented entries in /usr/lib/drf/tapeconfig.
    fz527399

  12. The command pwck(1M) should print the line being processed, when errors are encountered.
    erg712157 fz518020

  13. Fix locking of CD-ROM tray.
    fz527497

  14. The command sar -d returns busy values > 100%
    fz521100 erg501658

  15. Fixed bugs which caused the licensing daemons (ifor_pmd, ifor_sld, and sco_cpd) and the idmknodd daemon to be killed on transitions to init state 1 and never restarted.
    fz526649, fz526656

  16. The mousemgr process could not be run in init state 1.
    fz527032

  17. Updated /sbin/usb to only run when usbd is configured.
    fz527495

  18. Fixed potential problem evaluating constant expressions in full_optimization asm(1) functions.
    fz527501

  19. Panic in the routine v86bios0().
    fz526652

  20. Include support tool sysinfo(1M) in shipping product.
    fz519999

  21. Intel's fix for p6update panics on prototype Pentium 4 Xeon system.
    fz521607

  22. Kernel panic in kmem_alloc, from tcpopen.
    fz521356

  23. New tunable COREFILE_SECURE. Privileged, setuid or setgid processes are prohibited from dumping core. A new tunable COREFILE_SECURE, if tuned to 0, will allow such processes to core dump.
    fz526524/erg712163

  24. System hangs sporadically after calling execv directly after fork1 in multithreaded applications.
    fz526597

  25. Netscape postscript printing in kole (Korean) environment is broken.
    fz520071

  26. If the Skunkware ghostscript package is installed, the PostScript files (such as those printed by Netscape) can be automatically converted for printing on the PCL printers (such as HP LaserJet). An example of command to enter in the Netscape print dialog:

    
             lp -T PS 
    
    
  27. Correctly display version of dump command with -V option.
    fz518607

  28. Fix for missing charset attribute for Japanese documentation in DocView.
    fz526356

Development Fixes

  1. Assembly peep-hole optimizer (optim) fix for three operand integer multiplication by one which was not caught by the global optimizer on C++ code.
    fz526555

  2. C++ compiler fix: Unless in strict ANSI mode, allow an undefined inline function to be referenced if the point of reference is never used.
    fz526499 fz526480

  3. Debugging information for a "long long" local variable assigned to register pair %ebx/%esi was incorrectly stated as %ebx/%esp. C and C++ compilers fixed.

Compatibility Fixes

  1. (MP2) Fix for panic on certain OpenServer binaries.
    erg550013/fz514721

  2. (MP2) chown() arguments of -1 do not work for OpenServer binaries
    fz526683

Problems fixed in Maintenance Pack 2

uw713mp2 contains all the fixes listed above for Maintenance Pack 1, the fixes marked (MP2) delivered with Update Pack 1, plus the following fixes:

Security Fixes:
  1. uudecode does not validate the filename; it should not write to pipes or symbolic links.
    CSSA-2002-SCO.44

Networking Fixes:
  1. KMA corruption in tcp.
    fz521356/erg712086

  2. Status requests are not being automatically generated for a network printer if it is very busy resulting in job ids not being freed.
    erg501666/fz526164

  3. Hangs and delays in streams caused by streams routines unnecessarily allocating large physically contiguous buffers.
    fz527550/erg712266

Compatibility Fixes:
  1. Fixed system call restart code for OpenServer applications. Also modified code for the connect system call so that connect is properly restartable for OpenServer applications.
    fz527264

  2. System hangs during boot up on older (Pentium III and earlier) IBM hardware.
    fz527522

  3. Allow use of an ELF interpreter which contains a PT_NOTES section, as some older OpenServer libraries do.
    fz527571

  4. Enable 16-bit IPC IDs for OpenServer and Xenix compatibility.
    fz527373

  5. Implement support of MAP_NOEOF mmap flag for OpenServer applications running on UnixWare.
    fz527536

Miscellaneous Fixes:
  1. Fixed an unrecoverable "internal error" experienced by the debug command when reading some core files from threaded applications. Fixed the recently added -m command line option to specify an alternate runtime library path when analyzing core files from other systems.
    erg501675/fz526224/fz526635/fz526681

  2. The vtoc driver has been fixed to support disks whose physical sector size is an integral multiple of 512.
    erg501717/fz527726

  3. System may refuse to take console input after 248 days, thereby appearing to hang, due to invalid time stamps in the cmux driver.
    fz527517/erg501720

  4. The command useradd(1M) allows $ in usernames (SAMBA requirement)
    fz526483

  5. The ksh95 built in pwd command can output pathnames starting with //.
    fz199364

  6. PSE memory remains unavailable after dynamically adding memory.
    erg712235/fz527455

  7. System hangs in vxfs filesystem. Processes blocked waiting on a call to vx_iget.
    erg712184/fz526355

  8. Restore the pre-7.1.3 lookuppn syntax so that third-party provided filesystems continue to work. The extra root vnode argument has been removed from lookuppn. A new lookuppnx function has been created with this extra argument.
    fz527503

Problems fixed in the Update Pack 2 Set

uw713up2 contains all the fixes listed above for Maintenance Pack 1, Update Pack 1, and Maintenance Pack 2, plus the following additional fixes.

Networking Fixes:
  1. Hangs and delays in streams caused by streams routines unnecessarily allocating large physically contiguous buffers.
    fz527550 erg712266

  2. If two arp -d's are called in quick succession, one of the entries may not be deleted.
    erg711628/fz516107

  3. When DNS is not configured, mailadmin (scoadmin mail) will not allow you to change any settings.
    erg712296/fz527783

  4. System panic due to a race condition in tcp timers code.
    erg501722/fz527554

  5. Fixed scoadmin DNS Manager' abnormal terminations; fixed corruption of DNS/BIND's configuration and zone data files caused by scoadmin DNS Manager; fixed ndc/rndc utility and interactions with DNS/BIND.
    fz518460 fz518604 fz521436

Compatibility Fixes:
  1. If the name of remote system for a remote printer is not found in /etc/lp/Systems, lpsched does not complain at startup and later on coredumps when a status or cancel request is sent to that printer.
    fz527931

  2. Remote print requests remain indefinitely in queue if remote system is down. They do not timeout even if timeout parameter is specified in /etc/lp/Systems for the corresponding remote system.
    fz527934

    WARNING: Since by default the timeout is set to 10 minutes, print setups with large network delays may suddenly experience timed-out jobs. For such systems, system administrators should either increase the timeout value or set timeout to "never" to restore old behavior.

Miscellaneous Fixes:
  1. System can refuse to take console input after 248 days, thereby appearing to hang, due to invalid time stamps in the cmux driver.
    fz527517 erg501720

  2. Short-lived floating point temp value may be left on the floating point stack when used within the second or third operand of a conditional operator. This may result in a floating point stack overflow.
    fz527712

  3. Potential floating point stack overflow detected in /usr/sbin/vxassist.
    fz527712

  4. Shell metacharacters that are part of the options to the C++ compiler are properly preserved (escaped) for reuse during recompilation done as part of C++ auto template instantiation.
    fz527527

  5. Fixed an unrecoverable "internal error" experienced by the debug command when reading some core files from threaded applications. Fixed the recently added '-m' command line option to specify an alternate runtime library path when analyzing core files from other systems.
    erg501675 fz526224 fz526635 fz526681

  6. The vtoc driver has been fixed to support disks whose physical sector size is an integral multiple of 512.
    erg501717 fz527726

  7. Fixed division by zero error in /usr/ccs/lib/optim encountered in calculating potential benefits of locals in a register for what appears to be a series of heavily nested loops.

  8. Fix to ps -o time so that when the accumulated CPU time exceeds 24 hours, the number of days is no longer off by one.
    fz527776/erg712295

  9. Change the "enum boolean" tag in /usr/include/sys/types.h to "enum __boolean", removing the type/tag "boolean" from the user name space.
    fz527818

  10. Add support for Digi ClassicBoard/PCI and Connect Blue Heat serial cards.
    fz527694

  11. System hangs in vxfs filesystem. Processes blocked waiting on a call to vx_iget.
    erg712184 fz526355

  12. Restore the pre UnixWare 7.1.3 lookuppn syntax so that third-party provided filesystems continue to work. The extra "root vnode" argument has been removed from lookuppn. A new lookuppnx function has been created with this extra argument.
    fz527503

  13. Status requests are not being automatically generated for a network printer if is very busy resulting in job ids not being freed.
    erg501666 fz526164

  14. Display per-processor callouts as well as global callouts from the callout command.
    fz527802

  15. Enhanced the Printing subsytem to have a maximum of 999 printjobs per printer or class of printers rather 999 printjobs for the whole system.
    erg501712/fz526370

  16. Lpsched performs poorly when a large number of jobs (200+) are submitted at once.
    erg501718/fz527462

  17. The sdipath -o repair command can hang when run against active paths.
    erg712254/fz527498

  18. PSE memory remains unavailable after dynamically adding memory.
    erg712235 fz527455

  19. Periodic Local timeouts can migrate to global callout lists. If a driver uses a dtimeout interface to schedule a periodic callout on a particular cpu, the callout migrates to the global list after the first firing. This then allows allows callout to be scheduled on any cpu.
    fz527675

  20. scoadmin now includes a graphical disk manager
    fz527823

  21. xAPIC support for IBM xSeries x440 servers - allows multiple CECs to be used and more than 8 logical CPUs
    fz526749 fz527522

  22. Fix the ksh problem where an empty assignment (for example, ksh -c 'x=; echo ${x/y/z}') would cause a memory fault.
    fz527943

  23. Change umask to 022 so that /etc/ssh.pid is not world writable.
    fz526605

  24. Correct /usr/sbin/sshd binary to use /usr/X/bin/xauth instead of /usr/X11R6/bin/xauth.
    fz526871

  25. Added STO_386_COPY support to RTLD and the linker to aid in the evolution of the IA32 psABI.
    fz527833

  26. Add support for the BSD and Linux asprintf() and vasprintf() routines. These two routines are additional *sprintf() variations. Here, you pass the address of a "char *" into which is placed a malloc()d buffer of sufficient length to hold the entire sprintf() result. The caller is responsible for free()ing the buffer when done.
    fz527834

  27. Correct /usr/include/sys/nattr.h definition of NATTR_CSUM_MASK.
    fz527534

Problems fixed in the Update Pack 3 Set

uw713up3 contains all the fixes listed above for Maintenance Pack 1, Update Pack 1, Maintenance Pack 2, and Update Pack 2, plus the following additional fixes.

Security Fixes:
  1. Fixed exploitable buffer overflows in metamail.
    erg712265 fz527543

  2. Drop TCP packets when both SYN & FIN are set.
    erg712274 fz527623

  3. sendmail char sign extension buffer overflow. Upgraded to Sendmail 8.12.9.
    erg712276 fz527629

  4. DocView no longer permits certain URLs from reading publicly-readable system files.
    fz528126 erg712368

  5. sendmail remotely exploitable buffer overflow in prescan.
    erg712433 fz528320 CSSA-2003-SCO.23

Networking Fixes:
  1. Kernel panics with a bad read pointer in a STREAMS message block, caused by mishandling of the message block in the STREAMS utility msgpullup and in the IP protocol handling routine ip_input.
    erg712321 fz527939

  2. Some STREAMS ioctl coomands involving multiple message exchanges with the driver may timeout prematurely and return EAGAIN erroneously.
    erg712396 fz528199

  3. Code generation error in ppp library.
    fz528222

  4. flock() hangs when the NFS server is Microsoft SFU (3.0)
    erg712347 fz528048

  5. Data corruption during TCP connection setup. A race condition could erroneously acknowledge enqueued data that has not been sent causing receiver to get partial data.
    erg712389 fz528172

Development Fixes:
  1. C/C++ inlining of a small function may attempt to use a FP constant as if it were and integer value in memory.
    fz528225

  2. Optimzation bug fix. Optim may erroneously remove a structure return temp space from the stack.
    fz528221:1

  3. C++ compiler internal error if shift operator amount is a 64 bit data type.
    fz528230

  4. Warning diagnostic for cc -Xc about intermixed statements and declarations could be issued inappropriately.
    fz527343

  5. The qsort() routine was reworked to increase performance, especially when presented with lots of "equal" data items.
    fz527984 fz528071

  6. The C compiler's preprocessing inappropriately took a '_' as starting a fresh token when in the middle of a "ppnumber" token. In practice, this only had an effect on code which created identifier tokens through pasting.
    fz528049

  7. The bsearch() routine was improved to handle zero-valued "size" and "number of items" parameters.
    fz528073

  8. cc -Xt no longer warns about "return;" for functions whose return type is other than void.
    fz528120

  9. A bug was repaired in which an inlined function call, having been passed a null pointer, would trigger an internal C compiler error when this parameter was the target of a strcpy() or strncpy() call.
    fz528141

  10. The obsolete ustat() routine has been moved from the unshared portion of the C library to the shared libc.so.1. The backward compatibility library libcudk70.a has an unshared ustat() added.
    fz528274

  11. The strip and mcs utilities no longer attempt to make use of the rename() system call to move the updated temporary file over the file being operated on.
    fz528164

Miscellaneous Fixes:
  1. When pkgadd fails early on, before any package has been selected, it gives the following message: UX:mailx: WARNING: No message !?! This message was confusing to users and is now not displayed.
    fz527750

  2. When hyperthreading is enabled on a uniprocessor system without MPS BIOS tables, the system will attempt to use a standard two cpu multiprocessor configuration to enable hyperthreading.
    fz527457

  3. Hyperthreading is disabled (erroneously) on some systems.
    erg712350 fz528053

  4. System hang. Hard hang unable to enter kdb or dump the system.
    erg712346 fz528045

  5. ksh93 autoload functions invoked within command substitution fail to execute.
    erg712312 fz527879

  6. /etc/conf/bin/idconfupdate now creates its .idlock file in /etc/conf instead of /var/tmp. This avoids idtools problems when /var/tmp is not mounted.
    fz528107:1 fz528129:1

  7. /etc/magic expanded to recognize Java class files and SVR4 pkgadd datastream image files.
    fz160445, fz527896

  8. Large block sized i/o requests failing with Pre-DDI8 HBA drivers.
    fz527917:1 erg712316

  9. When reporting information for multiple files, /usr/bin/file may reference previously freed memory.
    fz219396

  10. Panic in specfs, NULL pointer dereference (s_cp).
    erg712337 fz528010

  11. /usr/ucb/lastcomm core dumps.
    fz528025

  12. syslogd fails to respond to SIGHUP.
    erg712414 fz528159

  13. /etc/magic has been expanded to provide recognition of of more file types.
    fz144358 fz528024

  14. /u95/bin/ksh users' `w` idle time resets every 10 min.
    erg712362 fz528070

  15. Added dacread,macread privileges to /usr/lib/fs/vxfs/quota.
    fz528196

  16. Fixed failures mounting/creating vxfs snapshots which indicated that the filesystem is either already mounted, busy, or the allowable number of mount point exceeded when none of these failure conditions were true.
    erg712361 / fz528100:1

  17. Fixed kernel stack overflows with lxuwfs, replacing relatively large stack variables with allocated areas. Matching change made to lxdevfs.
    fz527910 / fz528131

  18. /sbin/dfspace now does not list LKP and OKP mount points.
    fz519343:1

  19. Updated kcrash with bug fixes.
    fz528295

  20. Fixed scoadmin Slice Manager character mode display for cylinders and attributes views.
    fz528041

  21. Updated mkmsgs.
    fz527996, fz528200

  22. Updated swap command to handle swap files up to 4GB.
    fz202265

  23. Updated time zone data for India (IST).
    fz526471

  24. ksh95 built in pwd can output pathnames starting with //.
    fz199364

  25. When installing UnixWare on some machines with the nVidia GeForce4 video chipset, the screen goes black and the machines freezes after the initial kernel is loaded and before the language selection screen. Separate boot floppies are required to install such a system. The fix delivered in UP3 ensures systems installed in such a manner continue to work.
    erg712344 fz528030

  26. USB chipsets using the optional EHCI 64-bit addressing modes no longer get "Descriptor Read Failure load failed during enumeration" on USB startup.
    fz528043

  27. The USB drive from Melco/Yedata no longer fails on USB startup with "Inquiry Read failed, unbinding".
    fz528046

  28. DocView Print Book feature now handles documents that were not properly assembled for printing.
    fz527824

  29. Support logical volumes up to 1 TB. mkfs_vxfs failed on logical volumes > 512GB and fdisk reported invalid cylinders in "1 TB boundary" cases.
    fz520676 erg712311

  30. The queue command within crash prints garbage at the end of the line.
    fz528406

  31. The date command core dumps. Attempting to update the time via SCOadmin will display an error message, although the time does get updated.
    erg712397 fz528056

  32. The userdel command core dumps.
    fz528409

Problems fixed in the Update Pack 4 Set

uw713up4 contains all the fixes listed above for Maintenance Pack 1, Update Pack 1, Maintenance Pack 2, Update Pack 2, and Update Pack 3, plus the following additional fixes. Note that some of the fixes below were also include in Maintenance Pack 3; all Maintenance Pack 3 fixes are included in Update Pack 4.

Security Fixes:
  1. SECURITY - CRLF (Carriage Return, Line Feed) injection vulnerability in lynx.
    fz712379 fz528144

  2. Security fix for OpenSSL version 0.9.7b. See http://cvs.openssl.org/chngview?cn=11213.
    fz528383

  3. Fixed /proc security bug.
    fz712482 fz528474

  4. Fixed LKP chroot security vulnerability in intpexec
    fz528642 erg712519

Networking Fixes:
  1. Repaired a bug in the ftp daemon that would cause it to report "426 Data connection: Error 0" after a successful transfer.
    fz528430 fz528034

  2. Fixed problem where rcp of /proc causes denial of service.
    fz712112 fz525927

  3. Fixed a bug in traceroute that would cause it to core dump.
    fz528289

  4. An optimization to predict the MAC header size is now a tuneable. A value of 0 allows the OS to discover the optimal header size. A value less than 0 disables the optimization and a value above 0 enforces the value specified in the tuneable. This is specifically useful for applications like IBM SNA Gateway which provides a media frame header size different than calculated by the OS.
    fz527969

  5. There are three new tuneables provided: tcp_rexmit_min to control the minimum retransmission timeout value, tcp_rttdflt to specify a default initial RTT value and the tcp_maxrxt_min to allow configuration of cumulative minimum retransmission value.
    fz527766

Development Fixes:
  1. C/C++ inlining of a function or type "char *" into an expression that expects an integer type expression may result in an internal compiler error.
    fz528442

  2. DT_RUN_PATH formats accepted with the -R option of the CC (C++) command have been expanded to include $ORIGIN and relative paths.
    fz528471

  3. The Java first-class executables feature has been upgraded to support Java 1.4.2.
    fz528476

  4. The 'fs' memory checking tool within the UDK C++ compilation system has been fixed to handle the C++ standard library <memory> header.
    fz528482

  5. Optimization bug fix. /usr/ccs/lib/optim does not properly track source memory usage for the third operand of a three operand SHLDL instruction.
    fz528620

  6. The C++ compiler would emit incorrect code to handle object cleanup during exception handling throw processing, when the object was of a multidimensional array of classes type.
    fz528674

  7. C/C++ compilers may encounter an internal compiler error when handling a cast of a volatile type to a void type.
    fz528689

  8. Fixed problem where programs linked with libthread that call fork1() from the original thread produce children that are not properly protected from signals in critical library code.
    fz528522

  9. Changed libc's internal %f and fcvt() formatting to give a slightly more accurate result when more digits are requested than are handled internally.
    fz528370

  10. Corrected some exported libc symbols that should have been weak to be so.
    fz528448

  11. Fill-in some missing iconv (command and library routine) codeset conversion to permit direct conversion to/from UTF-8 and the following codesets: PC437, PC850, PC860, PC863, PC865, 8859/1, eucJP, and sjis. The same effect was available before this by using a "unicode" (UCS2) intermediate codeset target.
    fz528539

  12. Repair a qsort() bug in which an incorrect internal swap routine can be used.
    fz528569

  13. Changed the Motif (libXm and libWXm) libraries to be built using the system's strcasecmp() and register expression routines.
    fz528651

  14. Repaired a bug in libthread such that a null pointer can be dereferenced in cond_broadcast() after a fork1().
    fz528714

  15. Changed libthread's timer mechanism so it recognizes hard system clock resets.
    fz712390 fz527957

  16. Fixed RTLD exit() processing to prevent a segmentation fault observed when a loaded-at-startup shared libary dlopen()s some other library and then uses its _fini() routine to dlclose() this other library. Previously, the RTLD exit() processing resulted in the dlclose() causing a segmentation fault as it attempts to modify memory through a null pointer.
    fz528933

Miscellaneous Fixes:
  1. Fixed panic in realitexpire.
    fz712352 fz528064

  2. The rtpm command incorrectly reports it is out of memory and exits; the time reported by rtpm gets out of sync with the system clock.
    fz712441 fz528135 erg712393 fz528133

  3. Shared memory that is in use by a process experiencing a fork failure might not be released.
    fz712399 fz528204

  4. System hang; infinite loop in deadflck.
    fz712154 fz526541

  5. Ksh sleep call is waiting forever due to missed SIGALRM.
    fz712386 fz528169

  6. The multibyte to wide-character conversion code for EUC was broken.
    fz712507 fz528536

  7. cs daemon allows 2 child processes to talk to the same device.
    fz501731 fz527737

  8. System call entry handler for linux binaries will panic if a real device is attached to the same vector or if a spurious interrupt is received on that vector.
    fz712348 fz528051

  9. Corrected permissions on various /etc/inst/locale/*/menus/LKP/lxrpms.msgs files. These permissions were correct for systems which had a fresh Unixware 7.1.3 ISL installation. The permissions were incorrect for customers who had upgraded from to UnixWare 7.1.3 from a prior UnixWare/Open UNIX release.
    fz520137

  10. MAXRUN is a new cron tuneable parameter in /etc/default/cron. It defaults to 25 and defines the number of simultaneous cron jobs in the system.
    fz712469 fz528435

  11. Fix libDtHelp buffer overflow problem.
    erg712445 fz528372

  12. Fix bug in mousemgr which causes graphical login to fail to restart after logout when using a serial mouse.
    fz528706

  13. Ensure that /etc/conf/bin/idcpunix invokes rm -rf from a directory with a known path to avoid certain failures which can occur when invoking /etc/conf/bin/idcpunix (and therefore rm -rf) from a directory with no known path. Also, add the directory /etc/conf.unix.old/mod.d to the loadable module search path after moving the current loadable module directory there.
    fz527874 fz527875

  14. The compress command dies with a SIGSEGV, and fails to compress the file.
    fz712220 fz527292

  15. Fixed problem where embedded EHCI on IBM 8430/13x took inordinate amount of time to reset.
    fz501727 fz527381

  16. Packaging change to samba and sambamb packages.
    fz526999

  17. sysi86 doesn't validate selector when clearing a descriptor.
    fz521540

  18. Updated Scoadmin Video Configuration Manager to stay set to VESA if configured to VESA and not switch to an autodetected video adapter configuration.
    fz528393

  19. /etc/magic was updated to handle the OSR5 tar format.
    fz528854:1

  20. Auto-enabling of memory above 4GB. When the OS detects memory above 4GB, it automatically enables PAE mode in order to access the memory above 4GB. Previously, this had to be done manually, by setting ENABLE_4GB_MEM=yes in /stand/boot followed by a reboot.
    fz528501:3

Fixes Included in Update Pack 2 Supplemental Packages

The following fixes are not included in the Update Pack Set; they are installed with the indicated package provided on the Update Pack CD. See Update Pack CD Contents.

  1. adst70 - Provide updated adst70 HBA driver to prevent a panic going into init 1.
    fz527526

  2. basex - Avoid potential duplicate data being flushed from buffers when the child process, used for initial house keeping, in the pseudo tty client open transport function exits.
    fz527709

  3. nd - Updated Intel PRO/100 driver (eeE8) to version 2.5.4. Bug fixes and new card support.
    fz527508 fz527922

  4. nd - Updated Intel PRO/1000 driver (e1008g) to version 7.0.11. Bug fixes and new card support.
    fz527502 fz527911

  5. nd - Correct typos in Intel PRO/1000 (e1008g) Drvmap file affecting hotplug support for certain NICS.
    fz527792

  6. nics - Short Ethernet frames are now padded with octets of zero to prevent information leakage.
    erg712090 fz521367

  7. openssh - SECURITY Provide rlogin/telnet login replacements to correct flawed kill routine.
    fz526587

  8. openssl - SECURITY Upgraded OpenSSL version to fix timing attack vulnerability.
    fz527507

  9. samba and sambamb - SECURITY Upgraded Samba version to fix security holes where anonymous or remote users could gain root access.
    fz527530 fz527681

  10. xdrivers - Matrox G100/G200/G400 Series Graphics driver (mtx) doesn't close pcix driver causing xserver package to hang during installation.
    fz527729

  11. xdrivers - Provide support for Nvidia TNT2, GeForce2 and Quadro2 Graphics adapters.
    fz527795

  12. zlib - SECURITY Fix a zlib (gzprintf) format string overflow vulnerability by rebuilding the zlib library to use snprintf().
    fz527490

Problems Fixed in Update Pack 3 Supplemental Packages

The following fixes are not included in the Update Pack Set; they are installed with the indicated package provided on the Update Pack CD. See Update Pack CD Contents.

  1. basex, j2jre131, xfonts - The /usr/lib/X11/fonts/TrueType/watanabe-mincho.ttf Japanese font has been removed from these packages, and is removed from the system when you install these packages on top of a previous version.
    fz528440

  2. nd - Updated Intel PRO/1000 driver (e1008g) to version 7.2.10. Bug fixes and new card support.
    fz528257

  3. nd - Updated Broadcom NetXtreme Gigabit Ethernet driver (bcme) to version 6.0.16. Corrects panic in bcopy+13 with bcme v6.0.3.
    fz527953 fz528305

  4. netmgmt - The SNMP trap_rece utility trap_rece quits prematurely with the error message Couldn't assign requested address.
    erg712289 fz527728

  5. nics - A new dlpi driver tuneable in /etc/conf/pack.d/dlpi/space.c allows the administrator to turn off MAC header size prediction, which causes problems on IBM SNA Gateway systems. See Known Problems.
    527969

  6. nics - Changed ndcfg for PCI device recognition to fix a bug which prevented some serial port boards from being recognized.
    erg712319 fz527935

Problems Fixed in Update Pack 4 Supplemental Packages

The following fixes are not included in the Update Pack Set; they are installed with the indicated package provided on the Update Pack CD. See Update Pack CD Contents.

  1. apache - Updated to 1.3.29 to pick up latest fixes.

  2. nd - Fixed 'nd' package menu option #2 install. Install failed to work properly when installing on either UnixWare 7.1.1 or Open UNIX 8.0.0.
    fz527574

  3. nd - Updated AMD PCnet driver (pnt) to version 3.0.1. Fixes a panic that appeared in bcopy().
    fz527095

  4. nd - Updated 3Com EtherLink DDI8 driver (e3bc) to version 1.1.1. Fixes a bad ASSERT panic in the DEBUG kernel on startup. Only occurs in DEBUG kernel.
    fz528447

  5. nd - Updated Intel PRO/100 driver (eeE8) to version 2.6.8. Bug fixes and new support.
    fz528724

  6. nd - Updated Intel PRO/1000 driver (e1008g) to version 7.2.15. Bug fixes and new support.
    fz528381

  7. nd - Updated Broadcom NetXtreme Gigabit Ethernet driver (bcme) to version 7.0.7. Bug fixes and new card support.
    fz528589

  8. nd - Updated tcpdump(1M) command to fix the following security vulnerabilities:

    erg712544 fz528784

  9. nics - netconfig fails to configure network card properly in certain situations with multiple NICS.
    erg712451 fz528400

  10. xdrivers - Provide support for ATI Radeon 7000, 7200 and 7500 Graphics adapters.
    fz528394


© Copyright 2004 The SCO Group, Inc. All rights reserved.