Sun patch pulled (was Re: HP & Export of DCE)

I noticed that Sun's latest libc patch (101759-04) is empty.  Previous
versions contained the complete U.S. version of libc, including the
tres-dangerous DES and crypt functions.  In the current rev only the
README remains, presumably because:
        EXPORT INFORMATION: This patch includes code which performs
        cryptographic functions, which are subject to U.S. export
        control, and must not be exported outside the U.S. without
        prior approval of the U.S. government.  Prior export approval
        must be obtained by the user of this patch.

So, you might ask, what fixes is Sun not distributing???
    (Rev 04)
        1190985 gethostbyname() can trash an existing open file descriptor.
        1182835 portmapper silently fails with version mismatch by PC-NFS
                client
        1219835 Syslog(3) can be abused to gain root access on 4.X systems.

Yup, that's right.  The syslog hole that was so well publicized by
CERT will remain open indefinitely because the ITAR makes it illegal
for Sun to distribute the fix!

So did HP and Sun spontaneously, simultaneously develop crypto awareness,
or is some gummint dweeb whispering threats in their ear?

>
>I noticed that Sun's latest libc patch (101759-04) is empty.  Previous
>versions contained the complete U.S. version of libc, including the
>tres-dangerous DES and crypt functions.  In the current rev only the
>README remains, presumably because:
>        EXPORT INFORMATION: This patch includes code which performs
>        cryptographic functions, which are subject to U.S. export
>        control, and must not be exported outside the U.S. without
>        prior approval of the U.S. government.  Prior export approval
>        must be obtained by the user of this patch.
>
>So, you might ask, what fixes is Sun not distributing???
>    (Rev 04)
>        1190985 gethostbyname() can trash an existing open file descriptor.
>        1182835 portmapper silently fails with version mismatch by PC-NFS
>                client
>        1219835 Syslog(3) can be abused to gain root access on 4.X systems.
>
Yes, all very dangerous, but, come on, how hard is it to call sun
to get a copy of the patch? (answer, it's not). This is not that big
of a deal.

>Yup, that's right.  The syslog hole that was so well publicized by
>CERT will remain open indefinitely because the ITAR makes it illegal
>for Sun to distribute the fix!
>
It's easy to patch yourself too. I had a patch for this three days after
it was announced, distributed via anon FTP and bugtraq. Basically, replacing
syslog.c with one that Perry had written and adding an snprintf.c function.
I've discontinued offering this since Sun's patch is now available.

>So did HP and Sun spontaneously, simultaneously develop crypto awareness,
>or is some gummint dweeb whispering threats in their ear?
>

Who cares as long as they distribute the patch? The international libc
patch is still freely available to anyone who wants it.


--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress

The syslog problem is fixed in baseline SunOS 5.5.

Sun and HP are apparently doing what the stupid law mandates - and they
should do so, whether someone at NSA (or whatever) is on their case or
not.  :)  They should also have someone in their respective legal
departments bucking ITAR very hard.

"tres-dangerous" must have been typed with a snear, no?

ECafe Anonymous Remailer wrote:
> 
> I noticed that Sun's latest libc patch (101759-04) is empty.  Previous
> versions contained the complete U.S. version of libc, including the
> tres-dangerous DES and crypt functions.  In the current rev only the
> README remains, presumably because:
>         EXPORT INFORMATION: This patch includes code which performs
>         cryptographic functions, which are subject to U.S. export
>         control, and must not be exported outside the U.S. without
>         prior approval of the U.S. government.  Prior export approval
>         must be obtained by the user of this patch.
> 
> So, you might ask, what fixes is Sun not distributing???
>     (Rev 04)
>         1190985 gethostbyname() can trash an existing open file descriptor.
>         1182835 portmapper silently fails with version mismatch by PC-NFS
>                 client
>         1219835 Syslog(3) can be abused to gain root access on 4.X systems.
> 
> Yup, that's right.  The syslog hole that was so well publicized by
> CERT will remain open indefinitely because the ITAR makes it illegal
> for Sun to distribute the fix!
> 
> So did HP and Sun spontaneously, simultaneously develop crypto awareness,
> or is some gummint dweeb whispering threats in their ear?