Patch-ID# 110287-15

NOTE:
***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Keywords: security core clients tooltalk database server buffer overflow
Synopsis: OpenWindows 3.6.2_x86: Tooltalk patch
Date: Dec/22/2006


Install Requirements: NA                      
                      
Solaris Release: 8_x86

SunOS Release: 5.8_x86

Unbundled Product: OpenWindows

Unbundled Release: 3.6.2_x86

Xref: This patch is available for SPARC as 110286

Topic: 

Relevant Architectures: i386

BugId's fixed with this patch: 4284511 4334998 4363822 4379430 4417781 4476458 4499995 4518469 4522203 4668701 4707187 4713445 4871091 6235250 6257227 6328571

Changes incorporated in this version: 6257227

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

/usr/dt/lib/nls/msg/C/SUNW_TOOLTALK.cat
/usr/openwin/bin/rpc.ttdbserverd
/usr/openwin/bin/ttsession
/usr/openwin/lib/libtt.so.2

Problem Description:

6257227 ttsession grows in heap memory and response times increase
 
(from 110287-24)
 
6328571 Inefficient code in while loop
 
(from 110287-13)
 
6235250 ttsession cores with a corrupted .TTauthority file
 
(from 110287-12)
 
4284511 XSUNTRANSPORT=shmem can crash dtsession
 
(from 110287-11)
 
4871091 dtmail cannot open attached mail
 
(from 110287-10)
 
4713445 buffer overflow in the ToolTalk library
 
(from 110287-09)
 
4707187 multiple vulnerabilities in Tooltalk database server
 
(from 110287-08)
 
4668701 64bit ToolTalk clients cannot connect with ttsession
 
(from 110287-07)
 
4476458 _Tt_c_procid::set_default_session dumps core on Solaris 7 & 8
 
(from 110287-06)
 
4522203 libtt crashes and burns when ttsession cannot be reached
 
(from 110287-05)
 
4518469 pkgadd of SUNWtltk fails in the latest S8U7 nightly build
 
(from 110287-04)
 
4499995 format string vulnerability in ToolTalk Database Server
 
(from 110287-03)
 
4417781 Login failed after patchadd of 105802-14
 
(from 110287-02)
 
4379430 After patchadd of 105802-12, login failed
4363822 ttsession memory leak
 
(from 110287-01)
 
4334998 Loopback automount maps and 107893-07 cause failed CDE logins, hangs

Patch Installation Instructions:
-------------------------------- 
Refer to the man pages for instructions on using 'patchadd' and 'patchrm'
scripts provided with Solaris.  Any other special or non-generic
installation instructions should be described below as special
instructions.  The following example installs a patch to a standalone
machine:
 
	example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
	example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.

Special Install Instructions:
----------------------------- 
 
NOTE 1:  After applying the patch to enable -Q option to set the warn and disconnect
         message counts, change line below in /usr/dt/bin/Xsession file
 
         from:
                dtstart_ttsession="$DT_BINPATH/ttsession"
         to:
                dtstart_ttsession="$DT_BINPATH/ttsession -Q warn=<value>,discon=<value>"
 
         where <value> is an integer. Then logout and login through dtlogin for the
         patch to take effect.
 
NOTE 2:  After doing (1) to enable/disable logging of messages on the fly.
 
                kill -s SIGUSR1 <ttsession PID>.
 
         The warn/disconnect messages will get logged in /var/adm/messages .
 
NOTE 3:  To get Ttsession usage list please run
 
                /usr/openwin/bin/ttsession --usage

README -- Last modified date:  Friday, December 22, 2006

