Document version: 7 October 2014
This readme applies to SecureTransport 4.9.2 SP2, 5.1 SP3, 5.2.1 SP4. This patch installs and operates on the following platforms and installation types only:
The information in this Readme supersedes any corresponding information in the documentation (online or printed) previously supplied for the product.
File Package: bash.exe
MD5 checksum: 67a916d172d241566e2a41360b662fa8
Size: 610304
Bash 3.2.57 provides the following corrections and enhancements:
| CVE Identifiers | Internal ID | Description |
|---|---|---|
| Initial report CVE-2014-6271 |
134071,134072 | The
original form of the vulnerability involved a specially crafted
environment variable containing an exported function definition,
followed by arbitrary commands. Bash incorrectly executes the trailing
commands when it imports the function. The bug was corrected with a
patch to the program. However, after the release of the patch there
were subsequent reports of different, yet related vulnerabilities. |
| CVE-2014-6277 | 134071,134072 | This relates to the parsing of function definitions in environment variables by Bash and causes a segfault. |
| CVE-2014-6278 | 134071,134072 | This relates to the parsing of function definitions in environment variables by Bash. |
| CVE-2014-7169 | 134071,134072 | This relates to the parsing of function definitions in environment variables by Bash. |
| CVE-2014-7186 | 134071,134072 | This relates to an out-of-bounds memory access error in the Bash parser code. |
| CVE-2014-7187 | 134071,134072 | This relates to an off-by-one error, allowing out-of-bounds memory access, in the Bash parser code. |
In a streaming environment, stop all of the protocol servers and services on all of the SecureTransport Edge servers before you start applying the patch. Update the SecureTransport Server first and then update of the SecureTransport Edge servers.
In a cluster environment, apply the patch to the nodes one at a time. Stop all of the protocol servers and services on a node before you start applying the patch. After a node is upgraded, start all SecureTransport services and proceed with the upgrade of the next node in the cluster.
This patch applies for Windows platform only.
To update SecureTransport application to Bash 3.2.57 on Windows, follow the steps below where:
<FILEDRIVEHOME> represents the directory where SecureTransport is installed<FILEDRIVEHOME>\bin\stop_all command.<FILEDRIVEHOME>\var\run\ directory.cron service, are closed.
Check the Users tab in the Windows Task Manager to make sure no one else is using Cygwin.
If necessary, close the Cygwin console and tools manually.<FILEDRIVEHOME>\cygwin\bin with the new one.
<FILEDRIVEHOME>\bin\start_all command.To remove Bash 3.2.57 on Windows, follow the steps below where:
<FILEDRIVEHOME> represents the directory where SecureTransport is installed<FILEDRIVEHOME>\bin\stop_all command.<FILEDRIVEHOME>\var\run\ directory.cron service, are closed.
Check the Users tab in the Windows Task Manager to make sure no one else is using Cygwin.
If necessary, close the Cygwin console and tools manually.<FILEDRIVEHOME>\cygwin\bin\bash.exe file. Overwrite the current bash.exe with the one restored from the backup.For further information or assistance with this Patch, contact Axway Global Support.
Copyright © Axway Software 2014
All rights reserved