Security Issues

The following security issues applies to the Solaris 10 release.

Nonpassword Logins Fail With pam_ldap Enabled

After the account management PAM module for LDAP (pam_ldap) is enabled, users must have passwords to log in to the system. Consequently, nonpassword-based logins fail, including those logins that use the following tools:

• Remote shell (rsh)

• Remote login (rlogin)

• Secure shell (ssh)

Workaround: None.

New Versions of encrypt() and decrypt() Are Not Backward Compatible

Output files that are generated by encrypt() are processed by the corresponding decrypt(). The current release uses a new version of encrypt() and decrypt(). These commands process files whose format differs from files that earlier versions generated and processed. Data that is encrypted by using the earlier encrypt() can no longer be recognized correctly by the new decrypt().

For more information, refer to the encrypt(1) and decrypt(1) man pages.

Workaround: To convert old encrypted data so that the data can be processed by the new encrypt() and decrypt() version, perform the following steps:

1. Decrypt the existing data by using the earlier version of decrypt().

2. Re-encrypt the same data by using the new encrypt().

Incorrect Parameters Might Cause Panic in Sun StorEdge T3 (4319812)

A Sun StorEdge T3 system might panic if an application uses the HTTP interface to send tokens with out-of-range parameters.