Details:
This patch resolves a buffer overflow vulnerability in VERITAS Cluster Server 3.5 for AIX.

This patch can be applied to P2 only. All other 3.5 versions must first be upgraded to 3.5 P2 before applying this patch. VERITAS Cluster Server 3.5 P2 is part of VERITAS AIX Applications 1.0 Maintenance Pack 3: http://support.veritas.com/docs/272645 


All versions of VERITAS Cluster Server 3.5 on AIX are affected and should be upgraded to P2 and this patch applied.

For further information on this vulnerability, refer to http://support.veritas.com/docs/279870 which also contains links to patches for other platforms and versions.

This patch also contains a number of fixes for incidents not related to security (see below).

Refer to the information included in the patch file for installation instructions


Download Now  -  19233 K
File Name: AIX_VCS3.5P2+i18n-secfix-e418977a_279945.tar.Z
File Type: Patch

Click Below to Browse the FTP files by Product:
ftp.support.veritas.com/pub/support/products

Related Documents:

272645:   VERITAS AIX Applications 1.0 Maintenance Pack 3
 http://support.veritas.com/docs/272645


279870: Symantec Security Advisory SYM05-023 VERITAS Cluster Server for UNIX: Local Access Buffer Overflow Vulnerability
 http://support.veritas.com/docs/279870

Supplemental Material:

System: Ref.#	Description
ETrack: 251650	Reject setting frozen = 1 and tfrozen = 1 at same time.
ETrack: 254859	HAD assert failure when remaining node in 3-node cluster is stuck in LEAVING state.
ETrack: 256416	Maintain AutoStart state across failovers.
ETrack: 267994	HAD core when group is changed from Parallel to Failover.
ETrack: 284786	When server returns ECONREFUSED, localhost should retry before exit.
ETrack: 312812	Modify halog for UTF8 encoding.
ETrack: 322217	Removed unnecessary call from hacf.
ETrack: 368367	Modify ha commands to show output when debug log tag is set.
ETrack: 426545	Add engine check for username password length.
ETrack: 426548	Packaging changes to remove root suid in some binaries.

---