Patch-ID# 103671-06
Keywords: security y2000 sdtcm calendar overwrite rpc.cmsd year 2000
Synopsis: CDE 1.0.1: dtcm sdtcm_convert rpc.cmsd patch
Date: Dec/03/98

Solaris Release: 2.4 2.5

SunOS Release: 5.4 5.5

Unbundled Product: CDE

Unbundled Release: 1.0.1

Xref: This patch available on CDE 1.0.2 as patch 103670

Relevant Architectures: sparc

BugId's fixed with this patch: 1250240 1264172 1264389 4056819 4072526 4056822 4116961 4184188

Changes incorporated in this version: 4184188

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch:

	/usr/dt/bin/sdtcm_convert
	/usr/dt/bin/rpc.cmsd
	/usr/dt/bin/dtcm
	/usr/dt/lib/nls/msg/C/dtcm.cat

Problem Description: 

  4184188 sdtcm_convert has buffer overflow

(from 103671-05)
  4116961 year2000 patch for CDE1.0.2 dtcm is incomplete (and broken)

(from 103671-04)
  4056822 Find 'To' date validation non y2000 compliant.      
  4056819 Cde1.0.2 Recurring yearly appointment is permitted
	  on 29/2 (Leap Year).
  4072526 Cde1.0.2 dtcm post year 2000 "View"->"go to date"
	  fails if year is defaulted to an incorrect date.

(from 103671-03)
  1264389 rpc.cmsd security problem.

(from 103671-02)
  1264172 CDE 1.0.1 and 1.0.2 sdtcm_convert security
	  vulnerability.

(from 103671-01)
  1250240 sdtcm_convert can be used to overwrite files.


Patch Installation Instructions:
-------------------------------- 
Refer to the Install.info file for instructions on using the
generic 'installpatch' and 'backoutpatch' scripts provided with
each patch.  Any other special or non-generic installation
instructions should be described below as special instructions.


Special Install Instructions: 
----------------------------- 
None.
