Wandering Thoughts archives

More on the Solaris ssh stuff (part 3)

As an update on the Solaris ssh stuff and to sort of answer a question left in comments on here:

I brought another Solaris machine up to the current patchlevels today, which let me see what the current state of affairs is. The best answer is that it's confusing and not fixed yet.

• patch 112908-24 and 112908-25, the apparently bad versions of the 'krb5 shared obj' patch, have been very thoroughly removed.
• 112908-23 remains available on the patches.sun.com website, but it is not mentioned in patchdiag.xref. In fact, according to patchdiag.xref there is no currently valid version of 112908 (and -24 and -25 are not explicitly in there marked as bad and withdrawn, either; instead they've just been Stalinized).
• 113273-11 (sshd) and 114356-08 (ssh) remain in patchdiag.xref as the only live versions. They are recommended patches, and 113273-11 is marked as a security patch as well.
• However, both 113273-11 and 114356-08 specifically require 112908-24, the unavailable krb5 patch; they will fail to install on a system with 112908-23.

Thus, Sun has quietly removed 112908-24 and 112908-25 as buggy but failed to withdraw or fix patches that depend on it. The result is that you cannot install a recommended Sun security patch, and of course the situation is not fixed in the least. (The only true fix for the situation is for Sun to release new, non-buggy versions of the patches. For some reason they haven't yet gotten around to this.)

The best workaround for now is to manually install the last good versions of the bad patches; you want 113273-10 and 114356-06. Pca will handily do this for you.