ShellShock and Latest Version Problem

ShellShock and Latest Version Problem

[Dennis Putnam]

[-- Attachment #1: Type: text/plain, Size: 312 bytes --]

According to the cygwin web site the latest version that contains the
shellshock patch is 1.7.32. I ran setup-x86_64.exe to get the latest
patches but I wind up with version 1.7.16 and nothing later is found. My
cygwin test indicates it is still vulnerable. How do I get 1.7.32 if not
through setup? TIA.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 196 bytes --]

Re: ShellShock and Latest Version Problem

[René Berber]

On 10/4/2014 2:55 PM, Dennis Putnam wrote:

> According to the cygwin web site the latest version that contains
> the shellshock patch is 1.7.32. I ran setup-x86_64.exe to get the
> latest patches but I wind up with version 1.7.16 and nothing later
> is found. My cygwin test indicates it is still vulnerable. How do I
> get 1.7.32 if not through setup? TIA.

Shellshock is related to the bash version, not the Cygwin version.

If you updated Cygwin and think you still have an older version (of
Cygwin), that probably means that you didn't stop all processes that
use the Cygwin dll.

Updating Bash doesn't affect, or depend, on the Cygwin dll.
-- 
René Berber


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: ShellShock and Latest Version Problem

[Dennis Putnam]

[-- Attachment #1: Type: text/plain, Size: 1030 bytes --]

Thanks for the reply. I assumed that since bash was part of basic Cygin,
if I updated everything, bash would be included. I had Cygwin completely
down when I updated with setup. Why did I not get the latest bash with
the other updates? How to I get the right version of bash other than
with setup?

On 10/4/2014 4:38 PM, René Berber wrote:
> On 10/4/2014 2:55 PM, Dennis Putnam wrote:
>
>> According to the cygwin web site the latest version that contains
>> the shellshock patch is 1.7.32. I ran setup-x86_64.exe to get the
>> latest patches but I wind up with version 1.7.16 and nothing later
>> is found. My cygwin test indicates it is still vulnerable. How do I
>> get 1.7.32 if not through setup? TIA.
> Shellshock is related to the bash version, not the Cygwin version.
>
> If you updated Cygwin and think you still have an older version (of
> Cygwin), that probably means that you didn't stop all processes that
> use the Cygwin dll.
>
> Updating Bash doesn't affect, or depend, on the Cygwin dll.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 196 bytes --]

Re: ShellShock and Latest Version Problem

[René Berber]

On 10/4/2014 4:38 PM, Dennis Putnam wrote:
> On 10/4/2014 4:38 PM, René Berber wrote:
>> On 10/4/2014 2:55 PM, Dennis Putnam wrote:
>>
>>> According to the cygwin web site the latest version that contains
>>> the shellshock patch is 1.7.32. I ran setup-x86_64.exe to get the
>>> latest patches but I wind up with version 1.7.16 and nothing later
>>> is found. My cygwin test indicates it is still vulnerable. How do I
>>> get 1.7.32 if not through setup? TIA.
>> Shellshock is related to the bash version, not the Cygwin version.
>>
>> If you updated Cygwin and think you still have an older version (of
>> Cygwin), that probably means that you didn't stop all processes that
>> use the Cygwin dll.
>>
>> Updating Bash doesn't affect, or depend, on the Cygwin dll.
> 
> Thanks for the reply. I assumed that since bash was part of basic Cygin,
> if I updated everything, bash would be included. I had Cygwin completely
> down when I updated with setup. Why did I not get the latest bash with
> the other updates? How to I get the right version of bash other than
> with setup?

Use setup.  Don't assume it doesn't work, it does work fine.

Check the version available shown in setup, it its not (as of today)
4.1.16 then the _mirror_ you are using is stale (which would explain why
you didn't get the latest version of Cygwin).
-- 
René Berber


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: ShellShock and Latest Version Problem

[Tim Prince]

On 10/4/2014 6:56 PM, René Berber wrote:
> On 10/4/2014 4:38 PM, Dennis Putnam wrote:
>> On 10/4/2014 4:38 PM, René Berber wrote:
>>> On 10/4/2014 2:55 PM, Dennis Putnam wrote:
>>>
>>>> According to the cygwin web site the latest version that contains
>>>> the shellshock patch is 1.7.32. I ran setup-x86_64.exe to get the
>>>> latest patches but I wind up with version 1.7.16 and nothing later
>>>> is found. My cygwin test indicates it is still vulnerable. How do I
>>>> get 1.7.32 if not through setup? TIA.
>>> Shellshock is related to the bash version, not the Cygwin version.
>>>
>>> If you updated Cygwin and think you still have an older version (of
>>> Cygwin), that probably means that you didn't stop all processes that
>>> use the Cygwin dll.
>>>
>>> Updating Bash doesn't affect, or depend, on the Cygwin dll.
>> Thanks for the reply. I assumed that since bash was part of basic Cygin,
>> if I updated everything, bash would be included. I had Cygwin completely
>> down when I updated with setup. Why did I not get the latest bash with
>> the other updates? How to I get the right version of bash other than
>> with setup?
> Use setup.  Don't assume it doesn't work, it does work fine.
>
> Check the version available shown in setup, it its not (as of today)
> 4.1.16 then the _mirror_ you are using is stale (which would explain why
> you didn't get the latest version of Cygwin).
Slightly off topic, I tend to put off updating from setup due to the
default of rolling gcc back to an earlier (buggier, in my tests)
version.  There are about 6 selections which have to be set to Keep to
avoid breaking it.

-- 
Tim Prince


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: ShellShock and Latest Version Problem

[Dennis Putnam]

[-- Attachment #1: Type: text/plain, Size: 453 bytes --]

On 10/4/2014 6:56 PM, René Berber wrote:
>
> Use setup.  Don't assume it doesn't work, it does work fine.
>
> Check the version available shown in setup, it its not (as of today)
> 4.1.16 then the _mirror_ you are using is stale (which would explain why
> you didn't get the latest version of Cygwin).
I've tried several mirrors at random and they all must be stale. What
mirror do you use so I can be sure to pick an up to date one? Thanks.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 196 bytes --]

Re: ShellShock and Latest Version Problem

[Yaakov Selkowitz]

On 2014-10-05 08:30, Dennis Putnam wrote:
> On 10/4/2014 6:56 PM, René Berber wrote:
>> Use setup.  Don't assume it doesn't work, it does work fine.
>>
>> Check the version available shown in setup, it its not (as of today)
>> 4.1.16 then the _mirror_ you are using is stale (which would explain why
>> you didn't get the latest version of Cygwin).
> I've tried several mirrors at random and they all must be stale. What
> mirror do you use so I can be sure to pick an up to date one? Thanks.

Again, don't assume.  By now almost all the mirrors have the latest 
bash.  You might want to try deleting your setup download cache.


Yaakov


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: ShellShock and Latest Version Problem

[Dennis Putnam]

[-- Attachment #1: Type: text/plain, Size: 815 bytes --]

On 10/5/2014 9:40 AM, Yaakov Selkowitz wrote:
> On 2014-10-05 08:30, Dennis Putnam wrote:
>> On 10/4/2014 6:56 PM, René Berber wrote:
>>> Use setup.  Don't assume it doesn't work, it does work fine.
>>>
>>> Check the version available shown in setup, it its not (as of today)
>>> 4.1.16 then the _mirror_ you are using is stale (which would explain
>>> why
>>> you didn't get the latest version of Cygwin).
>> I've tried several mirrors at random and they all must be stale. What
>> mirror do you use so I can be sure to pick an up to date one? Thanks.
>
> Again, don't assume.  By now almost all the mirrors have the latest
> bash.  You might want to try deleting your setup download cache.
>
>
> Yaakov
>
>

Thanks for the reply. Now who is assuming? :-) What/where is the
download cache?


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 196 bytes --]

Re: ShellShock and Latest Version Problem

[Yaakov Selkowitz]

On 2014-10-05 08:46, Dennis Putnam wrote:
> Thanks for the reply. Now who is assuming? :-) What/where is the
> download cache?

https://cygwin.com/cygwin-ug-net/setup-net.html#setup-localdir


Yaakov


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: ShellShock and Latest Version Problem

[Dennis Putnam]

[-- Attachment #1: Type: text/plain, Size: 324 bytes --]

On 10/5/2014 9:48 AM, Yaakov Selkowitz wrote:
> On 2014-10-05 08:46, Dennis Putnam wrote:
>> Thanks for the reply. Now who is assuming? :-) What/where is the
>> download cache?
>
> https://cygwin.com/cygwin-ug-net/setup-net.html#setup-localdir
>
>
> Yaakov
>
That did it. I never would have found that. Thanks.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 196 bytes --]