IBM® Sterling Connect:Direct® for Microsoft Windows 4.7.0
Fix List Document

This document describes maintenance updates for IBM® Sterling Connect:Direct® for Microsoft Windows 4.7.0. It includes information and instructions for all product features, including the Server, Requester, Common Utilities, Secure+, JRE, solidDB and the SDK. Maintenance updates are always cumulative and provided as fix packs or interim fixes (iFixes).

Contents
•	Important Notices
•	About Fix Packs and iFixes
•	Before running the Installer Executable
•	Applying a Fix Pack or iFix to an existing Installation
•	Performing a new Installation or an Upgrade of an existing Installation
•	Description of iFixes and Updates

Important Notices

•	IBM Sterling Connect:Direct for Microsoft Windows 4.7.0.6 introduced support for 'Operator' user local functional authority type. To support this functionality both, Sterling Connect:Direct Requester and Sterling Connect:Direct for Microsoft Windows server must be upgraded to 4.7.0.6, 4.8.0.1, 6.0.0.2 or later.

•	An InstallShield vulnerability (CVE-2016-2542) was disclosed by Flexera, which affects all base, fix pack and iFix installers prior to IBM Sterling Connect:Direct for Microsoft Windows 4.7.0.4. The vulnerability was address in version 4.7.0.4 and later. For more information, and when installing a version prior to 4.7.0.4, review the security bulletin at http://www.ibm.com/support/docview.wss?uid=swg21979075:
Security Bulletin: Vulnerability in InstallShield affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2016-2542)

•	There have been some reports of antivirus software detecting a threat within Sterling Connect:Direct for Windows, resulting in the normal operation of Connect:Direct being blocked. IBM believes the threat results to be a false positive. You should ensure that you have the latest updates for your antivirus software and in case of any questions, please contact IBM Technical Support.

•	Starting with version 4.7.0.5, CD Secure+ Admin Tool (SPAdmin) and CD Secure+ CLI (SPCli) will display warnings when deprecated cipher suites or protocols are configured. Since these cipher suites and protocols can expose your node to known vulnerabilities, it is highly recommended that you update your Secure+ configuration accordingly. Please not that deprecated cipher suites and protocols may be disabled in a future update.

•	When applying an iFix or fix pack to IBM Sterling Connect:Direct for Microsoft Windows installed in a failover cluster environment, run the installer executable on each machine in the cluster where the product is installed. Follow the instructions outlined in the cluster white paper at http://www-01.ibm.com/support/docview.wss?uid=swg27040600:
Deploying IBM Connect:Direct in a Microsoft Windows Failover Cluster

•	When installing or updating IBM Sterling Connect:Direct SDK for Windows and using the Active X controls, verify that the CDStats.ocx and CDSubmit.ocx components are registered correctly. If they do not function properly, use regsvr32.exe to first unregister and then register these components again.

About Fix Packs and iFixes

Fix packs and interim fixes (iFixes) deliver maintenance and updates to an existing product version of IBM Sterling Connect:Direct for Microsoft Windows. They are cumulative and include iFixes as well as updates added since the previous fix pack and in any earlier fix pack. You only need to apply the latest one available. Fix packs and critical iFixes can be downloaded from the IBM Fix Central website at https://www.ibm.com/support/fixcentral/. Non-critical iFixes are typically provided by IBM support in response to a customer PMR to address the reported issue.

Fix packs and iFixes are provided as a single installer executable (.EXE). File naming conventions refer to the product name, version, fix pack (fp) and iFix (if), if applicable. Here are some examples:

•	Sterling Connect:Direct (CDWindows) fix pack 4.7.0.5
4.7.0.5-SterlingConnectDirectforMicrosoftWindows-x86-fp0005.exe

Sterling Connect:Direct (CDWindows) iFix 4.7.0.4_iFix023
4.7.0.4-SterlingConnectDirectforMicrosoftWindows-x86-fp0004-if023.exe
•	Stand-alone Sterling Connect:Direct Requester (CDRequester) fix pack 4.7.0.5
4.7.0.5-SterlingConnectDirectRequesterStandAlone-x86-fp0005.exe
•	Sterling Connect:Direct SDK/SDK.Net (CDSDK) fix pack 4.7.0.5
4.7.0.5-SterlingConnectDirectSDK-x86-fp0005.exe

Before running the Installer Executable

•	Review the fix list document (CDWin470FixList.rtf) carefully. It provides details on individual fixes, updates and changes included in a fix pack. It includes information on all features including Server, Requester, Common Utilities, Secure+, JRE, solidDB and SDK. 
•	Log on with an account that has appropriate permissions to install software, typically an administrator account. When performing a silent mode installation, make sure the command prompt or batch file already has this permission prior to executing the actual command, for example by using 'Run as administrator' (RAA).
•	Take a backup, if applicable.
•	Close all other applications.

Applying a Fix Pack or iFix to an existing Installation

Use the installer executable to apply a fix pack or iFix to an existing installation of IBM Sterling Connect:Direct for Microsoft Windows 4.7.0. Enable the patch mode by specifying SEPATCH_ONLY_FLAG=1 on the command line (default).
Interactive Mode
To apply a fix pack or iFix interactively, simply double-click the installer executable in Windows Explorer or run it without any arguments from the command line. This is equivalent to the following command:
<InstallerExe> /v"SEPATCH_ONLY_FLAG=1 /l*v CDWinPatch.log"
Silent Mode
To apply a fix pack or iFix in silent mode, enter the following command line:
<InstallerExe> /v"SEPATCH_ONLY_FLAG=1 /l*v CDWinPatch.log /qn" /s /w /clone_wait
The command will wait for completion (/w /clone_wait) and return 0 if the operation was successful. Review the log file in case of failure. Include this log file when reporting an installation problem to IBM customer support.

Performing a new Installation or Upgrade of an existing Installation

Use the installer executable to perform a fresh installation of IBM Sterling Connect:Direct for Microsoft Windows 4.7.0 or to upgrade from an existing older release. Enable the installation/upgrade mode by overwriting the command line.
Interactive Mode
To install or upgrade interactively, enter the following command line:
<InstallerExe> /v"/l*v CDWinInst.log"
Silent Mode
To install or upgrade in silent mode, enter the following command line:
<InstallerExe> /v" CD_SRVR_INI_FILE=C:\cd_srvr.ini /l*v CDWinInst.log /qn" /s /w /clone_wait
The command will wait for completion (/w /clone_wait) and return 0 if the operation was successful. Review the log file in case of failure. Include this log file when reporting an installation problem to IBM customer support.
For more infomation on customizing and automating the installation, review the Getting Started Guide or the Enterprise Deployment Guide in the IBM Knowledge Center at https://www.ibm.com/support/knowledgecenter/SS4PJT_5.2.0/cd_52_welcome.html.

Description of iFixes and Updates

iFixes after 4.7.0.0

4.7.0.0_iFix001:  RTC423820 / APAR IT01628
Description of Issue:  When extracting a configuration using CD Configuration Tool (CDConfig.exe), some values greater than 254 are not displayed correctly. The affected parameters included the session related Initialization Parameters (Initparms.cfg: sess.pnode.max, sess.snode.max, sess.total, sess.default) and the Short/Long Term Retry Attempts in the Netmap (Map.cfg: SRetry/LRetry).
Description of Fix:  Switched to another write function for the mentioned parameters.
Fix Availability Date:  14 May 2014
High Impact:  N
Reported Severity:  4

4.7.0.0_iFix002:  RTC422291 / APAR IT01363
Description of Issue:  Event log message were still showing the product name in uppercase, like "CONNECT:Direct".
Description of Fix:  The product name and event text source had already been updated to "Connect:Direct" many years ago. However these changes did not take effect until now.
Fix Availability Date:  14 May 2014
High Impact:  N
Reported Severity:  4

4.7.0.0_iFix003:  RTC423150 / APAR IT02000
Description of Issue:  CSPA204E written to statistics when Sterling Control Center Secure Connection settings are changed.
Description of Fix:  Fixed.
Fix Availability Date:  13 May 2014
High Impact:  N
Reported Severity:  4

4.7.0.0_iFix004:  RTC423196 / APAR IT02002
Description of Issue:  Silent Installation fails when included Secure+ Client Key Certificate configuration. Error: SPCL103E rc=8 Invalid key word "CipherSuite". 
Description of Fix:  Fixed.
Fix Availability Date:  13 May 2014
High Impact:  N
Reported Severity:  3

4.7.0.0_iFix005:  RTC424498 / APAR IT01934 / CVE-2014-0963
Description of Issue:  Vulnerability related to Record Processing in TLS 1.0 and later which can result in high CPU Utilization that requires a system reboot to resolve.
Description of Fix:  Updated the version of GSKit.
Fix Availability Date:  30 May 2014
High Impact:  Y
Reported Severity:  2

All iFixes and fix packs listed above are accumulated in fix pack 1 (4.7.0.1).

iFixes after 4.7.0.1

4.7.0.1_iFix001:  RFE 401559 (ID 40797) / APAR IT03451
Description of Issue:  Simple clicking OK button in CD Secure+ Admin tool, without changing any value is updating the node's record file.
Description of Fix:  Updated SPAdmin to only write the record when the node was changed.
Fix Availability Date:  29 July 2014
High Impact:  N
Reported Severity:  5

4.7.0.1_iFix002:  RTC408632 / RFE 405966 (ID 42671) / APAR IT00728
Description of Issue:  Sterling Connect:Direct for Windows Total Max Sessions enforcement
Description of Fix:  Added a new initialization parameter sess.total. It works similar to sess.pnode.max and sess.snode.max, except that it limits the maximum concurrent connections for all remote nodes in total. Valid numeric values are 1 to 510. The initial value if not specified is the sum of sess.pnode.max plus sess.snode.max.
Fix Availability Date:  05 August 2014
High Impact:  N
Reported Severity:  5

4.7.0.1_iFix003:  RTC435753 / APAR IT04317
Description of Issue:  CSPA303E, CSPE004E and CSPE005E errors occurring sporadically under high concurrency and when Strong Password Encryption (SPE) is enabled.
Description of Fix:  Resolved a threading issue and updated the version of GSKit. Improved exception handling to avoid a potential crash situation.
Workaround:  Temporarily disabled SPE.
Fix Availability Date:  09 September 2014
High Impact:  N
Reported Severity:  2

4.7.0.1_iFix004:  RTC436568 / RFE 400238 (ID 40159) / APAR IT04447
Description of Issue:  Enable millisecond timestamp on statistics records in Sterling Control Center.
Description of Fix:  The Connect:Direct Windows server now stores millisecond time resolution on some of the existing time stamps saved in its statistics logs. Please note that a Connect:Direct API client can choose whether or not to display the extra millisecond time resolution characters now available.
Fix Availability Date:  29 September 2014
High Impact:  N
Reported Severity:  5

4.7.0.1_iFix005:  RTC437894 / APAR IT04504
Description of Issue:  Sterling Control Center was unable to catch up on statistics with a busy Connect Direct Windows node. Select Statistics queries started to take longer and longer to complete. The Connect Direct Windows node responded slowly and solidDB started to create lots of temporary files (sxs*.*).
Description of Fix:  Widely increased the performance for the type of Select Statistics queries initiated by Sterling Control Center. These queries specify the LIMIT parameter and do not include wildcards or SFILE/DFILE.
Workaround:  See the following Technote at https://www.ibm.com/support/entdocview.wss?uid=swg21682729: Many solidDB® temp files are being created and it caused the Connect:Direct Disk to fill up and CD statistic cannot be collected.
Fix Availability Date:  22 September 2014
High Impact:  N
Reported Severity:  2

4.7.0.1_iFix006:  RTC432574 / APAR IT04498
Description of Issue:  A destination file may become corrupt when the user manually deletes the partial file but not the associated CKPT file while awaiting a checkpoint/restart. When the restart occurs, the first bytes up to the last valid checkpoint will all be 0 and the transfer continues from that point on.
Description of Fix:  Updated the code to restart the transfer from the beginning of the file.
Fix Availability Date:  23 September 2014
High Impact:  N
Reported Severity:  3

4.7.0.1_iFix007:  RTC446820 / APAR IT05253 / CVE-2014-3566
Description of Issue:  The SSLv3 protocol contains a number of weaknesses including POODLE (Padding Oracle On Downgraded Legacy Encryption, CVE-2014-3566). IBM Sterling Connect:Direct for Microsoft Windows is therefore also vulnerable when the SSLv3 protocol is used.
Recommendation:  SSLv3 is an obsolete and insecure protocol. Use the TLS protocol instead. To fully disable SSLv3 and use TLS instead, ensure that all secure connections are configured to 'Enable TLS Protocol' and 'Disable Override'.
Description of Fix:  Only enabled the protocols in the SSL handshake that are explicitly allowed for a connection.
Fix Availability Date:  04 November 2014
High Impact:  Y
Reported Severity:  2

4.7.0.1_iFix008:  RTC448109 / APAR IT05464
Description of Issue:  Setup allows installation on unsupported Windows OS. While the installation or upgrade may complete successfully, the product will fail to run.
Description of Fix:  Updated the minimum OS requirements for Setup to match the Release Notes: Microsoft Windows 7, Microsoft Windows Server 2008 R2 or higher (VersionNT>=601).
Fix Availability Date:  10 November 2014
High Impact:  Y
Reported Severity:  2

All iFixes and fix packs listed above are accumulated in fix pack 2 (4.7.0.2).

iFixes after 4.7.0.2

4.7.0.2_iFix001:  RTC436583 / RFE 407782 (ID 40949) / APAR IT05951
Description of Issue:  Enable option to automatically delete a process from the TCQ after connection retries have been exhausted.
Description of Fix:  Added a new initialization parameter conn.retry.exhaust.action. Valid values are hold or delete.
hold - Places Processes in the hold queue in “Held in Error” status after all retry attempts are used. This is the default value and retains the prior behavior of Connect:Direct.
delete - Causes the Processes to be permanently deleted from the TCQ after all short term and long term retries have been exhausted. The following example shows how to enable the Delete feature:
[TCQ Information]
conn.retry.exhaust.action=delete
Also added a new message id LCPF003E: Process Retry exceeded for &pname &pnum
Fix Availability Date:  26 November 2014
High Impact:  N
Reported Severity:  5

4.7.0.2_iFix002:  RTC446327 / APAR IT05789
Description of Issue:  Parsing a process that contains PDS-like files names fails. For example, CD Requester fails to validate a process specifying FILE="del.me(+1)": The parameter is invalid.
Trying to submit the process from the CLI fails too: An unhandled error occurred!
Description of Fix:  Fixed a compatibility issue with VS 2013.
Fix Availability Date:  26 November 2014
High Impact:  N
Reported Severity:  3

4.7.0.2_iFix003:  RTC416379 / APAR IT05862
Description of Issue:  Data corruption occurring at a subsequent COPY step when it gets restarted before the first checkpoint has been received. This only occurs when Windows is SNODE writing the destination file.
Description of Fix:  Added code to update the ckpt file in-between COPY steps.
Fix Availability Date:  02 December 2014
High Impact:  N
Reported Severity:  2

4.7.0.2_iFix004:  RTC436475 / APAR IT05895
Description of Issue:  Processes have been submitted to the TCQ while Strong Password
Security (SPE) was enabled. These processes with fail with LUPC028I and LUPC006I once the Connect:Direct Windows server has been restarted.
Description of Fix:  Fixed a length issue when decrypting process text.
Fix Availability Date:  03 December 2014
High Impact:  N
Reported Severity:  2

4.7.0.2_iFix005:  RTC419555 / APAR IT01361
Description of Issue:  Message File Automatic Import.
Description of Fix:  The Connect:Direct message file will be automatically imported into the message database while applying a fix pack, unless disabled by the user through specifying LAUNCHMSGIMP=0 on the fix pack command line. To import new messages manually, run the CD Message Import Utility.
Fix Availability Date:  16 December 2014
High Impact:  N
Reported Severity:  4

4.7.0.2_iFix006:  RTC451252 / RFE 445016 (ID 60501) / APAR IT06113
Description of Issue:  Connect:Direct Windows SDK for x64 bit Windows Platform in C++.
Description of Fix:  Provided 64-bit versions of CdCore.lib and CdCore.dll in a new x64 folder.
To build the C++ samples for the x64 platform, please remove your existing *.sln and *.vcxproj files from the CPPSample1 and CPPSample2 folders before applying this fix. Once the fix has been applied, start with opening the new *.vcxproj files.
Fix Availability Date:  17 December 2014
High Impact:  N
Reported Severity:  5

4.7.0.2_iFix007:  RTC451116 / APAR IT06200 / CVE-2014-8730
Description of Issue:  A Transport Layer Security (TLS) padding vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) like attack affects IBM Sterling Connect:Direct for Microsoft Windows.
Description of Fix:  Enabled the GSK_STRICTCHECK_CBCPADBYTES setting in GSKit to check for strict compliance with the TLS RFC.
Fix Availability Date:  19 December 2014
High Impact:  Y
Reported Severity:  2

4.7.0.2_iFix008:  RTC451886 / APAR IT06256
Description of Issue:  The CLI help is missing the LIMIT keyword in the Select Statistics command help.
Description of Fix:  Added the following text to the "help select statistics;" output:
	[limit     = number of entries]
Fix Availability Date:  30 December 2014
High Impact:  N
Reported Severity:  4

4.7.0.2_iFix009:  RTC451923 / APAR IT06263
Description of Issue:  Message SSRV134I not logged correctly.
Description of Fix:  Added proper process name and number information and fixed the &PNUM value in the message data.
Fix Availability Date:  30 December 2014
High Impact:  N
Reported Severity:  4

4.7.0.2_iFix010:  RTC452029 / APAR IT06282
Description of Issue:  Summary message SCPA085I shows wrong SNODE name on wildcard copy receive. It shows the pnode's name instead.
Description of Fix:  Fixed.
Fix Availability Date:  02 January 2015
High Impact:  N
Reported Severity:  3

4.7.0.2_iFix011:  RTC452049 / APAR IT06289
Description of Issue:  Enhance the LCOA014I message to provide more details on failed logon attempts.
Description of Fix:  The OS system error code is now logged as the feedback code (FDBK) and the specified userid is added to the message data. Here are some typical error codes and their meaning:
1326: Logon failure - unknown user name or bad password.
1331: Logon failure - account currently disabled.
1385: Logon failure - the user has not been granted the requested logon type at this computer.
Fix Availability Date:  02 January 2015
High Impact:  N
Reported Severity:  5

4.7.0.2_iFix012:  RTC452149 / APAR IT06308
Description of Issue:  The CD Change Notification Utility (ChNotify.exe) shows invalid values or fails with an error: Encountered an improper argument. Saving the configuration will corrupt the Notification settings in the registry. As a result, the Connect:Direct Server will show an LCRG011I error during startup: The data stored in the registry is out of range - CDRG_reg2mem.
Description of Fix:  Fixed a side effect introduced by 4.7.0.2_iFix001.
Fix Availability Date:  06 January 2015
High Impact:  N
Reported Severity:  2

All iFixes and fix packs listed above are accumulated in fix pack 3 (4.7.0.3).

iFixes after 4.7.0.3

4.7.0.3_iFix001:  RTC453745 / APAR IT07026 / CVE-2014-3065
Description of Issue:  There is a vulnerability in IBM Runtime Environment Java Technology Edition, Version 7 that is used by IBM Sterling Connect:Direct for Microsoft Windows. The issue was disclosed as part of the IBM Java SDK updates in October 2014.
Description of Fix:  Updated the IBM Runtime Environment Java and moved its location to a new ibm_jre folder due to changes in the installer.
Fix Availability Date:  19 March 2015
High Impact:  Y
Reported Severity:  2

4.7.0.3_iFix002:  RTC459219 / APAR IT07670 / CVE-2015-0138, CVE-2015-0159
Description of Issue:  GSKit is an IBM component that is used by IBM Sterling Connect:Direct for Microsoft Windows. The GSKit that is shipped with IBM Sterling Connect:Direct for Microsoft Windows contains multiple security vulnerabilities including the "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. 
Description of Fix:  Updated the version of GSKit.
Fix Availability Date:  19 March 2015
High Impact:  Y
Reported Severity:  2

4.7.0.3_iFix003:  RTC457187 / APAR IT07984
Description of Issue:  Concurrent Session High Water Mark
Description of Fix:  The Concurrent Sessions High Water Mark count is the maximum number of sessions running concurrently. This is information only and requires no action. It is logged each day at midnight local time and at system shutdown in the SCNT record in statistics. A new LCNT001I message was introduced to provide visibility to the user: Concurrent Sessions High Water Mark count of &MAX occurred at &TIME.
Fix Availability Date:  26 March 2015
High Impact:  N
Reported Severity:  5

4.7.0.3_iFix004:  RTC462325 / APAR IT08243 / CVE-2015-2808, CVE-2011-3389
Description of Issue:  CBC ciphers are vulnerable to CVE-2011-3389 (BEAST Attack). Previous recommendation to mitigate CVE-2011-3389 was to not use CBC ciphers. RC4 ciphers are vulnerable to CVE-2015-2808 (Bar Mitzvah Attack). Current recommendation to mitigate CVE-2015-2808 is to discontinue use of RC4 ciphers. However, the remaining available ciphers are generally CBC ciphers.
Description of Fix:  Fixed code to mitigate CVE-2011-3389 (BEAST Attack).
Recommendation:  Sterling Connect:Direct for Microsoft Windows by default disables the RC4 stream cipher. If you enabled the RC4 stream cipher you are exposed to the RC4 “Bar Mitzvah” Attack for SSL/TLS. IBM recommends that you review your entire environment to identify other areas where you have enabled the RC4 stream cipher and take appropriate mitigation and remediation actions.
Fix Availability Date:  20 April 2015
High Impact:  Y
Reported Severity:  2

4.7.0.3_iFix005:  RTC459344 / APAR IT08410
Description of Issue:  Installation fails on a bare Windows system while trying to initialize Secure+. The following error message is shown in the installation log:
1: SPCli.log: Exception in thread "main" java.lang.UnsatisfiedLinkError: cdsp (The application has failed to start because its side-by-side configuration is incorrect. 
Description of Fix:  Added the Microsoft Visual C++ 2008 SP1 Redistributable package as a prerequisite to the installer.
Workaround:  Manually download the latest Microsoft Visual C++ 2008 SP1 (x86) Redistributable package from Microsoft and install it prior to installing Sterling Connect:Direct.
Fix Availability Date:  20 April 2015
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix006:  RTC465748 / APAR IT08979
Description of Issue:  The Control Pad window in CD Requester showing nodes and
commands is a bit too narrow. Sometimes command text may not fit into the window and a horizontal scroll bar appears. While the user can scroll or resize the window, it is an extra step for him to do so.
Description of Fix:  Increased the default windows size of the Control Pad to enhance usability.
Fix Availability Date:  19 May 2015
High Impact:  N
Reported Severity:  5

4.7.0.3_iFix007:  RTC463248 / APAR IT08977
Description of Issue:  The Microsoft Visual C++ 2013 Redistributable Package (x86) did not get installed on some x64 Windows systems as expected. 
Description of Fix:  While this has not caused any issues, the 3rd party install conditions have been fixed, so that the redistributable gets installed as expected.
In addition, the Microsoft Visual C++ 2013 Redistributable Package (x64) was added to the SDK installer, because the SDK does support x64 C++ executables now.
Fix Availability Date:  19 May 2015
High Impact:  N
Reported Severity:  4

4.7.0.3_iFix008:  RTC468875 / APAR IT09460
Description of Issue:  Sterling Control Center and the Application Interface for Java (AIJ) fail to update Secure+ configurations after applying 4.7.0.3_iFix001.
Description of Fix:  Updated the path to the JRE in the CMGR to point to the new JRE installation directory.
Fix Availability Date:  15 June 2015
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix009:  RTC469611 / APAR IT09613
Description of Issue:  CSPA320W warning occurring even when Secure+ was already disabled on the Snode by default: The Snode allowed a Pnode override to disable Secure+.
Description of Fix:  Updated the condition for CSPA320W to occur.
Fix Availability Date:  23 June 2015
High Impact:  N
Reported Severity:  4

4.7.0.3_iFix010:  RTC472434 / APAR IT10446
Description of Issue:  Process goes immediately from TIMR RE to HOLD HS on a TCP/IP timeout (LIPT011I, OS error 10060) and does not retry.
Description of Fix:  Removed the condition that had triggered HOLD HS, allowing the process to retry as expected.
Fix Availability Date:  31 July 2015
High Impact:  N
Reported Severity:  3

4.7.0.3_iFix011:  RTC467270 / APAR IT09724
Description of Issue:  Secure+ transfers failing when Windows is sending and the negotiated buffer size (RU Size) is less than 16384 bytes.
Description of Fix:  Updated the buffer size calculation.
Fix Availability Date:  06 August 2015
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix012:  RTC471699 / APAR IT10556
Description of Issue:  Connect:Direct API commands over a secure connection fail after upgrading the JRE in Connect:Direct Browser, Sterling Control Center or other application using the Application Interface for Java (AIJ).
Description of Fix:  Fixed.
Fix Availability Date:  10 August 2015
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix013:  RTC460012 / APAR IT11122
Description of Issue:  When a process fails with an exception response, like LSMG622I and SCPA024I, it was moved to the HOLD queue but with a wrong status of HS. As a side effect of this status, the process will get restarted at the next node startup.
Description of Fix:  Updated exception handling to correctly move the process to HOLD HE.
Fix Availability Date:  09 September 2015
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix014:  RTC477370 / APAR IT11470
Description of Issue:  Add the ability to create a configuration report from the CLI.
Description of Fix:  Updated the CLI (Direct.exe) and its internal help command to support the new parameter 'cdconfig' on the traceon command. The configuration report will be written to a file named cdconfig.txt created in the same folder as the specified trace file. For example, enter the following command line in the CLI to create a configuration report in C:\Temp\cdconfig.txt:
traceon file=C:\Temp\dummy.cdt config;
Fix Availability Date:  28 September 2015
High Impact:  N
Reported Severity:  5

4.7.0.3_iFix015:  RTC480632 / APAR IT11949 / CVE-2015-1788
Description of Issue:  An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit. IBM Sterling Connect:Direct for Microsoft Windows uses GSKit and addressed the applicable CVE.
Description of Fix:  Updated the version of GSKit.
Fix Availability Date:  23 October 2015
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix016:  RTC479415 / APAR IT11985
Description of Issue:  File Allocation Retry has been configured, for example to let the process retry when a remote GDG dataset is in use (retry.msgids=SDEGDGRI). Occasionally a remote node returned the retry-able msgid with a Completion Code of 16 (fatal error) instead of CC=8. In these cases the process got stuck in TIMR RE with Hold=Y and did not retry.
Description of Fix:  Ensured that the hold status is set to N when a process is scheduled for a retry. This allows File Allocation Retry even for fatal error conditions.
Fix Availability Date:  03 November 2015
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix017:  RTC482167 / APAR IT12170
Description of Issue:  A user manually modified a process text file outside of CD Requester and set $SNODE$="" in the CD Requester comments. When he opened the process in CD Requester afterwards, the SNODE value in the PROCESS statement got cleared out, too.
Description of Fix:  When available, CD Requester uses its comment to determine which PNODE and SNODE this process was designed for. The logic has been enhanced to not overwrite the PNODE or SNODE when $PNODE$="" or $SNODE$="" is found in CD Requester comments.
Fix Availability Date:  09 November 2015
High Impact:  N
Reported Severity:  5

4.7.0.3_iFix018:  RTC482534 / APAR IT12247
Description of Issue:  Improvements to the Secure+ API and CD Secure+ CLI (SPCli.cmd).
Description of Fix:  Enhanced the "Delete KeyStoreEntry" and "Import KeyCert" commands. See the Help command in SPCli.cmd for new parameters.
Fix Availability Date:  14 December 2015
High Impact:  N
Reported Severity:  5

4.7.0.3_iFix019:  RTC487432 / APAR IT12990
Description of Issue:  When parsing or validating a process, the parser silently truncates file names in COPY and SUBMIT statements when they are too long. It does not show any errors, allowing the process to be submitted with wrong file names.
Description of Fix:  Process validation will fail and the parser returns an error as expected.
Fix Availability Date:  13 January 2016
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix020:  RTC488558 / APAR IT13127 / CVE-2016-0201
Description of Issue:  A vulnerability has been addressed in the GSKit component of IBM Sterling Connect:Direct for Microsoft Windows.
Description of Fix:  Updated the version of GSKit.
Fix Availability Date:  14 January 2016
High Impact:  Y
Reported Severity:  2

4.7.0.3_iFix021:  RTC489446 / APAR IT13462
Description of Issue:  When copying text files to or from an EBCDIC remote node, Connect:Direct Windows translates ASCII data to EBCDIC and vice versa as needed. In some cases, an alternative to the default ASCII to EBCDIC translation provided by Connect:Direct Windows is desired.
Description of Fix:  While the product includes options for users to create their own custom xlate tables or to use codepage translation, for convenience, new xlate tables are provided that convert ISO-8859-1 ASCII text to IBM-037 EBCDIC and back. These xlate tables, ISOtoIBM.cdx and IBMtoISO.cdx, are located in the Server\xlate subfolder. They may be specified in copy step sysopts, or be made the default translation by specifying them in the Global Copy Parameters section of the initialization parameters.
Fix Availability Date:  28 January 2016
High Impact:  N
Reported Severity:  5

4.7.0.3_iFix022:  RTC489304 / APAR IT13617
Description of Issue:  Unable to use Group Authorities with the "Domain Admins" or "Administrators" Windows groups.
Description of Fix:  Previously Connect:Direct was ignoring any Windows group that did not have the SE_GROUP_ENABLED attribute set. This condition has been removed, so that these groups are no longer ignored.
Fix Availability Date:  04 February 2016
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix023:  RTC485463 / APAR IT13624
Description of Issue:  On a SUBMIT within process statement, occurrences of the word "local" or "remote" may incorrectly get replaced with "PNODE" and "SNODE". For example, passing along a variable &MYFILE=local.txt results in &MYFILE=PNODE.txt instead.
Description of Fix:  Removed deprecated code.
Fix Availability Date:  04 February 2016
High Impact:  N
Reported Severity:  3

4.7.0.3_iFix024:  RTC485087 / APAR IT13734
Description of Issue:  The Select Statistics command cannot filter for node or process names containing lower-case characters. Such names may come from a remote Sterling Connect:Direct UNIX node.
This issue only applies when the database is solidDB and the command is issued by a Windows SDK client, including CD Requester and the CLI. It does not apply to clients using the Application Interface for Java (AIJ).
Description of Fix:  Updated the SDK - and thus its clients - to preserve the case for node and process name specified on Select Statistics commands. Note that the parameters pname, pnode, snode and rmtnode are case-sensitive when the database is solidDB. 
Fix Availability Date:  11 February 2016
High Impact:  N
Reported Severity:  3

4.7.0.3_iFix025:  RTC490415 / APAR IT13950
Description of Issue:  When the destination filename gets too long on a wildcard COPY step, the file will be sent with a truncated destination filename.
Description of Fix:  Enhanced error handling for wildcard COPY steps and let the file fail with error LSMG265E instead: File name too long or invalid.
Also fixed an issue where the feedback code (FDBK) was not reported properly in the SCPA085I wildcard summary message.
Fix Availability Date:  24 February 2016
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix026:  RTC493142 / APAR IT14002
Description of Issue:  Processes may be coded with a snode that will invoke a Secure+ alias node when a session is attempted. In some cases, these session attempts can fail, reporting a CSPA201E message with reason text indicating "error setting ciphers".
Description of Fix:  Fixed code so that processes coded with a snode that will invoke a Secure+ alias node when a session is attempted will work properly.
Fix Availability Date:  26 February 2016
High Impact:  N
Reported Severity:  2

4.7.0.3_iFix027:  RTC488932 / APAR IT14104
Description of Issue:  Trying to create an alias node entry in Secure+ by using the CD Secure+ CLI (SPCli.cmd) or the Secure API fails with an error:
SPCL108E rc=8 All mandatory key word value pairs must be entered.
Description of Fix:  Fixed. Note the command will succeed, but with valid warnings:
SPCG774W rc=4 Node: MYALIAS - warning: This node is an alias for MYNODE, validation not performed.
SPCG420I rc=4 Create remote node command successful.
Fix Availability Date:  03 March 2016
High Impact:  N
Reported Severity:  3

4.7.0.3_iFix028:  RTC494448 / APAR IT14242
Description of Issue:  Trying to import an Initialization Parameters file (Initparms.cfg) fails with error LIPF008E for one of the following parameters: record.wrap, contact.name, contact.phone and descrip. Looking at the file, these parameters do not show a value assigned.
The file had been exported using CD Configuration Tool (CDConfig.exe) from a fresh installation, i.e. before the initialization parameters had not been applied at least once, like in CD Requester.
Description of Fix:  Updated the installation to properly initialize the record.wrap registry key. The other parameters will default to <None> now in alignment with other parameters.
Also updated server and CDConfig to ignore empty values rather than fail the operation.
Workaround:  Edit the Initparm.cfg file, add missing values and try the import again - or - Apply the initialization parameters once, like from CD Requester, before doing the export.
Fix Availability Date:  09 March 2016
High Impact:  N
Reported Severity:  3

4.7.0.4:  RTC494171 / APAR IT14315 / CVE-2016-2542
Description of Issue:  An InstallShield vulnerability was disclosed by Flexera. InstallShield is used by IBM Sterling Connect:Direct for Microsoft Windows. 
Description of Fix:  Addressed the applicable CVE.
Fix Availability Date:  09 March 2016
High Impact:  Y
Reported Severity:  2

4.7.0.4:  RTC456889 / APAR IT14578
Description of Issue:  Sterling Connect:Direct for z/OS added support for zEDC, which adds hardware acceleration support to zLib compression, but requires a compression window size of 15. The default is currently 13.
Description of Fix:  Changed the default Compression Windows size to 15.
Fix Availability Date:  16 March 2016
High Impact:  N
Reported Severity:  3

4.7.0.4:  n/a
Description of Issue:  Fast and Secure Protocol (FASP).
Description of Fix:  Added support for FASP. See the Release Notes for further information regarding support for FASP. 
FASP requires a license key for use. Download the license key from Passport Advantage when you download the fix pack.
Fix Availability Date:  16 March 2016
High Impact:  N
Reported Severity:  5

4.7.0.4:  RTC494775, RTC494777 / APAR IT16911 / CVE-2016-5991, CVE-2016-5992
Description of Issue:  IBM Sterling Connect:Direct for Microsoft Windows contains vulnerabilities that could allow a local user to increase their privileges or cause a denial of service when special conditions exist.
Description of Fix:  Addressed the applicable CVEs.
Fix Availability Date:  17 March 2016
High Impact:  Y
Reported Severity:  2

All iFixes and fix packs listed above are accumulated in fix pack 4 (4.7.0.4).

iFixes after 4.7.0.4

4.7.0.4_iFix001:  RTC500056 / APAR IT14990
Description of Issue:  2GB FASP pull from Sterling Connect:Direct Windows to Sterling
Connect:Direct Windows via Sterling Secure Proxy (SSP) fails. The process hangs in the TCQ in EX status.
Description of Fix:  Updated FaspStream components.
Fix Availability Date:  27 April 2016
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix002:  RTC480005 / APAR IT13962
Description of Issue:  Pipe characters are doubled (||) in a RUN TASK/JOB step on a Sterling Connect:Direct UNIX SNODE. This affects the way that the UNIX shell interprets the specified command line, because "|" and "||" have a different meaning.
Description of Fix:  Fixed. Also resolved a memory leak when FMH71 format conversion has failed (LSMG613I).
Fix Availability Date:  02 May 2016
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix003:  RTC500785 / APAR IT15059
Description of Issue:  SHA-2 private keys.
Description of Fix:  Added support for SHA-2 private keys to Secure+.
Fix Availability Date:  03 May 2016
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix004:  RTC502167 / APAR IT15278
Description of Issue:  Enhance the LSMG244I message to provide more details on failed logon attempts.
Description of Fix:  The OS system error code is now logged as the feedback code (FDBK). Here are some typical error codes and their meaning:
1326: Logon failure - unknown user name or bad password.
1331: Logon failure - account currently disabled.
1385: Logon failure - the user has not been granted the requested logon type at this computer.
Fix Availability Date:  13 May 2016
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix005:  RTC503830 / APAR IT15761
Description of Issue:  Submitting a new process does not fail gracefully when the TCQ is full. Instead the process gets an invalid process number of 0 assigned, leading to further errors and issues. Subsequent attempts to submit will hang.
Description of Fix:  Improved the logic to get the next available process number in regards to error handling, performance and testing all process numbers.
Fix Availability Date:  16 June 2016
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix006:  RTC503082 / APAR IT15901
Description of Issue:  The solidDB database is configured to listen on LocalHost only, but it listens on all network interfaces (0.0.0.0) instead.
Description of Fix:  Reconfigured solidDB to listen on 127.0.0.1.
Workaround:  Edit the solidDB6.5\cdwinnt\solid.ini file, locate the Listen property in the [Com] section and replace "LocalHost" with "-i127.0.0.1" within this property. Restart the "IBM solidDB - Connect Direct v4.7.0" service for the changes to take effect. For example:
[Com]
Listen=tcpip -i127.0.0.1 23470
Fix Availability Date:  28 June 2016
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix007:  RTC499730 / APAR IT16049
Description of Issue:  Fast and Secure Protocol (FASP) bridging through Sterling Secure Proxy (SSP).
Description of Fix:  Added support for FASP bridging through SSP. See the Release Notes for further information regarding support for FASP.
FASP requires a license key for use. Download the license key from Passport Advantage when you download the fix pack.
Fix Availability Date:  30 June 2016
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix008:  RTC502918 / APAR IT16047
Description of Issue:  A long running process is deleted instead of put on HOLD when trying to pause the process from CD Requester.
Description of Fix:  Resolved.
Fix Availability Date:  30 June 2016
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix009:  RTC502160 / APAR IT16005
Description of Issue:  Sterling Control Center and the Application Interface for Java (AIJ) fail to retrieve statistics for a badly coded RUN TASK that had failed with LSMR003I. The following errors appear in the Sterling Control Center logs:
CNCD024E Error getting stats from server. [...] Details: com.sterlingcommerce.scc.common.NodeServiceException: CNCD058E Error getting data from server. [...] Details: KQVString.parse() detected data problem at location 8
Description of Fix:  The short message text for LSMR003I, LSMR014I and LSMR015I included custom text from the command. This text has now been removed.
Fix Availability Date:  06 July 2016
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix010:  RTC507599
Description of Issue:  When receiving multiple concurrent large files, usually multi-terabyte, a Windows error 665 feedback code is sometimes received with an LSNF008i error. Microsoft indicates this is usually caused due to the file being written having too many fragments. In Connect:Direct, 20KB blocks of data are written to the disk file and with a terabyte file, this would be many blocks.
Description of Fix:  The write block size has been increased to 256KB reducing the number of blocks written and reducing the file fragments.
Fix Availability Date:  22 July 2016
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix011:  RTC507456 / RFE (ID 91139) / APAR IT16532 
Description of Issue:  When importing a keycert with an encrypted RSA private key, which uses the traditional SSLeay compatible format for private key encryption, the import keycert operation will fail reporting "PEM KeyStore open exception - asn1 parse failure: ..."  The further text will usually refer to an issue involving DER length or DER sequence. SPCli will also report an SPCG761E message.
Description of Fix:  Fixed code so that importing a keycert with an encrypted RSA private key works successfully.
Fix Availability Date:  26 July 2016
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix012:  RTC507880 / APAR IT16387
Description of Issue:  When a process was redirected by a remote Connect:Direct for z/OS PLEX manager, it occasionally did not continue immediately but was scheduled for a later retry using the short retry timer interval.
Description of Fix:  The product has been updated to let the redirected process restart to its new destination as a soon as possible, persistently.
Fix Availability Date:  29 July 2016
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix013:  RTC502169 / APAR IT16662
Description of Issue:  SDK functions WaitForCompletion() and CdWaitOnProcess() may return prematurely on busy nodes, suggesting that the process has already completed when it has not.
Description of Fix:  Updated the SDK's internal timing for checking processes on the TCQ.
Fix Availability Date:  18 August 2016
High Impact:  N
Reported Severity:  4

4.7.0.4_iFix014:  RTC502919
Description of Issue:  All directory restrictions for Download/Upload/Process/Program get wiped out when updating a User Functional Authority definition and the combined total length of directory names exceeds a large value (around 730 to 740 characters; may vary).
Description of Fix:  Resolved. The maximum length for each directory name is 255 characters.
Fix Availability Date:  07 September 2016
High Impact:  N
Reported Severity:  4

4.7.0.4_iFix015:  RTC496608 / RFE 399737 (ID 39962)
Description of Issue:  Enable client authentication for Secure+ client connections received from IBM Sterling Control Center, without a password.
Description of Fix:  Clients connecting from an AIJ based product like IBM Sterling Control Center, can use Secure+ certificates to authenticate client connections to the Connect:Direct Windows server.
Fix Availability Date:  07 September 2016
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix016:  RTC508300
Description of Issue:  Add support for Client Source IP Checking.
Description of Fix:  Client Source IP Checking is configured in Functional Authorities (optional). A new field has been added to Functional Authorities to specify one or more IP addresses and/or host names (comma separated) to be used to validate the Client connection's remote IP address or host name. If the validation fails, the Client connection is rejected.
Fix Availability Date:  07 September 2016
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix017:  RTC497388 / APAR IT17150
Description of Issue:  A process may start twice under rare conditions when the local node is busy with many processes starting to the same remote node and some of these sessions getting rejected. The symptoms include error messages like:
LSMR016I  Open of ckpt file failed. Errno=2
LSMG007I  Step return code file write failed. (fdbk=2)
LSMG235I  SMGR failed to open the user process return code file - No such file or directory
LTQA004I  Attempt to terminate a process, but TCQ handle invalid
Description of Fix:  Resolved.
Fix Availability Date:  21 September 2016
High Impact:  Y
Reported Severity:  2

4.7.0.4_iFix018:  RTC517545 / APAR IT18565
Description of Issue:  LCCA081I occurring when IBM Control Center requests a Secure+ Node Refresh.
Description of Fix:  Updated timeout for Secure+ API commands.
Fix Availability Date:  23 December 2016
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix019:  RTC522708 / APAR IT18566
Description of Issue:  The CD Configuration Utility (CDConfig.exe) stopped working while trying to extract user configuration. The problem was caused by some bad registry settings for User Functional Authority.
Description of Fix:  Fixed the application crash and updated CDConfig to display error messages when extraction has failed. Updated the code to reject usernames containing a backslash and to skip creating Order registry values for User Functional Authority.
Fix Availability Date:  23 December 2016
High Impact:  N
Reported Severity:  4

4.7.0.4_iFix020:  RTC509562 / APAR IT18600
Description of Issue:  When refreshing initialization parameters, any Retry Message IDs (retry.msgids) and Retry Error Codes (retry.codes) get added to the list over again instead of overwriting the current value. The list keeps growing with every refresh. Trying to reset the initialization parameters to "<None>" fails with an error: 
LIPF008E - Invalid value <None> for keyword retry.codes
Though you can still reset the initialization parameters by setting no value, like retry.msgids= or retry.codes=.
Description of Fix:  Resolved an issue introduced with 4.7.0.4. The specified values will overwrite the existing values.
Fix Availability Date:  29 December 2016
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix021:  RTC524705 / APAR IT18663
Description of Issue:  Attempting to bulk update all remote nodes, for example "update remotenode name=* protocol=defaulttoln", fails with an error in CD Secure+ CLI (SPCli.cmd):
SPCG271E rc=8 The specified node(s) ".Keystore" do not exist in this parmfile.
Description of Fix:  Excluded reserved node entries, like .Keystore, from wildcard updates.
Fix Availability Date:  05 January 2017
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix022:  RTC525020
Description of Issue:  SSL/TLS Handshake from Sterling Connect:Direct to Sterling Secure Proxy (SSP) fails when using a SHA-2 certificate and multiple protocols enabled.
Description of Fix:  Resolved.
Fix Availability Date:  16 January 2017
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix023:  RTC525545 / APAR IT18910
Description of Issue:  Codepage conversion fails with MBCS002E FDBK=-9 when the first record is very small and a subsequent record is much longer.
Description of Fix:  Optimized the codepage conversion to manage its buffers more efficiently. The updated code also requires significantly less memory, which can save up to 2,7 MB of memory per session manager.
Fix Availability Date:  16 January 2017
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix024:  RTC529700
Description of Issue:  The Certificate Viewer in CD Secure+ Admin Tool (SPAdmin) does not word wrap public keys.
Description of Fix:  Resolved. The public key values for RSA and EC now match IBM iKeyman representation.
Fix Availability Date:  20 February 2017
High Impact:  N
Reported Severity:  4

4.7.0.4_iFix025:  RTC528142 / APAR IT19770
Description of Issue:  The Secure+ KeyStore has an issue importing multiple certificates with the same the X509 Common Name (CN).
Description of Fix:  The Secure+ KeyStore requires each certificate to have a unique alias name which is used to associate Identity/KeyCerts with Secure+ Nodes. During certificate import, when label names are not provided, the alias name is generated from the X509 Common Name (CN) component of the Subject Name. In cases where the same CN is assigned to multiple certificates, the import may skip otherwise valid certificates. A unique ID generator has been added to allow multiple certificates using the same CN to co-exist. Use the new AddWithUniqueLabel option to import these certificates from the CD Secure+ Admin Tool (SPAdmin) or the CD Secure+ CLI (SPCli). 
Fix Availability Date:  20 February 2017
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix026:  RTC530106
Description of Issue:  Secure+ API performance enhancement.
Description of Fix:  Improved the performance of Secure+ API commands, for example when refreshing certificates is issued from IBM Control Center.
Fix Availability Date:  20 February 2017
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix027:  RTC528788 / APAR IT19769 / CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843
Description of Issue:  Vulnerabilities were reported in zlib. zlib is used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs.
Description of Fix:  Updated zlib components.
Fix Availability Date:  22 February 2017
High Impact:  Y
Reported Severity:  2

4.7.0.4_iFix028:  RTC529668 / APAR IT19772 / CVE-2016-2183
Description of Issue:  An OpenSSL vulnerability disclosed by the OpenSSL Project affects GSKit. IBM Sterling Connect:Direct for Microsoft Windows uses GSKit and therefore is also vulnerable. This vulnerability is known as the SWEET32 Birthday attack.
Recommendation:  IBM recommends that you review your entire environment to identify areas that enable DES/3DES cipher suites and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling DES/3DES cipher suites. You should verify disabling DES/3DES cipher suites does not cause any compatibility issues. Enable the below GSKit remediation when you cannot take the recommended action and disable DES/3DES cipher suites in your environment.
Description of Fix:  The fix adds the ability to engage a GSKit remediation for this vulnerability via a system environment variable named CD_GSK_OPTIONS. To enable the remediation, set the value of this system environment variable to GSK_ENFORCE_TDEA_RESTRICTION. Than cycle (stop and restart) Sterling Connect:Direct.
Caution:  The effect of this remediation is to arbitrarily break a session after 32 GB of data have been transmitted.
Aside from the GSKit remediation, CD Secure+ Admin Tool (SPAdmin) and CD Secure+ CLI (SPCli) have been enhanced to display warnings when deprecated cipher suites or protocols have been configured, which includes all cipher suites using an RC4, DES/3DES or no encryption algorithm and the SSLv3 protocol. Note that deprecated cipher suites and protocols may be disabled in a future update.
Fix Availability Date:  23 February 2017
High Impact:  Y
Reported Severity:  2

4.7.0.4_iFix029:  RTC528302
Description of Issue:  Update the IBM Runtime Environment Java Technology Edition to Java 8.
Description of Fix:  Bundled the latest IBM JRE version 8. Also resolved some issues with updating or uninstalling the ibm_jre folder.
Fix Availability Date:  23 February 2017
High Impact:  N
Reported Severity:  5

4.7.0.4_iFix030:  RTC526823 / APAR IT19511
Description of Issue:  Stability improvements when using codepage conversion.
Description of Fix:  Improved error handling to avoid a potential crash.
Fix Availability Date:  02 March 2017
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix031:  RTC532123
Description of Issue:  During the SPCli upgrade command, errors are missing when opening mulitple PEM or CMS KeyStores fail. Only the last error is reported.
Description of Fix:  Resolved.
Fix Availability Date:  08 March 2017
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix032:  RTC532108
Description of Issue:  CD Secure+ Admin Tool (SPAdmin) does not display the certificate chain in tree view.
Description of Fix:  Within the Certificate Manager main window, a list of certificates is displayed in a tree view. On the Key Cert tab, the key certificates are displayed as the root and expand to display the trusted chain associated with the key cert.
Fix Availability Date:  08 March 2017
High Impact:  N
Reported Severity:  4

4.7.0.4_iFix033:  RTC532111
Description of Issue:  When executing the SPCli command "Create RemoteNode name=xxx", the SPCli fails with "SPCL108E rc=8 All mandatory key word value pairs must be entered". Specifying only the node name is a valid scenario.
Description of Fix:  Resolved.
Fix Availability Date:  08 March 2017
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix034:  RTC532298
Description of Issue:  Fast and Secure Protocol (FASP) update.
Description of Fix:  Updated the FASP components.
Fix Availability Date:  10 March 2017
High Impact:  N
Reported Severity:  3

4.7.0.4_iFix035:  RTC527029
Description of Issue:  Process fails retry of a COPY receive step with checkpointing.
Description of Fix:  Resolved.
Fix Availability Date:  10 March 2017
High Impact:  N
Reported Severity:  2

4.7.0.4_iFix036:  RTC533419
Description of Issue:  Log file issue with one of the prerequisites when doing an interactive installation.
Description of Fix:  Resolved.
Fix Availability Date:  23 March 2017
High Impact:  N
Reported Severity:  2

All iFixes and fix packs listed above are accumulated in fix pack 5 (4.7.0.5).

iFixes after 4.7.0.5

4.7.0.5_iFix001:  RTC513697
Description of Issue:  Enable TCP KeepAlive during HSAO file transfer.
Description of Fix:  Implemented.
Fix Availability Date:  30 March 2017
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix002:  RTC535229
Description of Issue:  When importing a keycert that contains a chain of trusted certificates, the chain is not imported.
Description of Fix:  Resolved.
Fix Availability Date:  11 April 2017
High Impact:  N
Reported Severity:  2

4.7.0.5_iFix003:  RTC541462 / APAR IT21009
Description of Issue:  Unable to change the Base Record name for the local node in Secure+.
Description of Fix:  The Base Record name is not used in this version anymore and has been removed from the CD Secure+ Admin Tool (SPAdmin), except for the main window grid to identify alias record links. Also, when an alias record is selected for edit, the Edit Record dialog Node Name value now refers to the non-alias/actual node name.
Fix Availability Date:  13 June 2017
High Impact:  N
Reported Severity:  2

4.7.0.5_iFix004:  RTC539308 / APAR IT21091
Description of Issue:  Server crashes when a remote RUN TASK/JOB step for a Sterling Connect:Direct UNIX SNODE is missing SYSOPTS.
Description of Fix:  Resolved an issue introduced with 4.7.0.4_iFix002. The process will now complete with the RUN TASK/JOB failing with XRPM008I "No sysopts." as expected.
Fix Availability Date:  20 June 2017
High Impact:  Y
Reported Severity:  3

4.7.0.5_iFix005:  RTC516322
Description of Issue:  CD Requester may not display Secure+ information when loading Statistics or Process data from a file that was saved on another computer.
Description of Fix:  Updated CD Requester to display Secure+ fields when the node and its Secure+ version are unknown.
Fix Availability Date:  24 July 2017
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix006:  RTC546528 / APAR IT22876
Description of Issue:  There have been some reports of antivirus software detecting a threat within Sterling Connect:Direct for Windows, resulting in the normal operation of Connect:Direct being blocked. IBM believes the threat results to be a false positive.
Description of Fix:  Digitally signed the CDNT.exe executable with a certificate to confirm the software author and guarantee that the code has not been altered since it was signed. You can verify the certificate from the Digital Signatures tab of the CDNT.exe file properties.
Fix Availability Date:  20 October 2017
High Impact:  Y
Reported Severity:  2

4.7.0.5_iFix007:  RTC556372
Description of Issue:  Variable &PARAM is not resolved in the message short text for some instances of LSCF004I. Message data shows a value for &PARM instead.
Description of Fix:  Resolved.
Fix Availability Date:  20 November 2017
High Impact:  N
Reported Severity:  4

4.7.0.5_iFix008:  RTC556874 / APAR IT23332
Description of Issue:  CLI (Direct.exe) outputs the Certificate Subject value under Certificate Issuer in Select Statistics.
Description of Fix:  Resolved.
Fix Availability Date:  29 November 2017
High Impact:  N
Reported Severity:  4

4.7.0.5_iFix009:  RTC506295
Description of Issue:  CD Configuration Utility (CDConfig.exe) exports the fasp parameter incorrectly with blanks when its pnode or snode value is set to blank in initialization parameters or netmap. As a result, CDConfig displays an E018 error when opening or importing such a file: E018 Line contained extra unrecognized data (',').
Description of Fix:  Updated CDConfig to export the fasp parameter with all blanks removed.
Workaround:  Manually remove all blanks from the line highlighted in CDConfig. 
Fix Availability Date:  07 December 2017
High Impact:  N
Reported Severity:  4

4.7.0.5_iFix010:  RTC558818
Description of Issue:  When loading or editing a process in CD Requester, it removes quotes from file names that does not contain a ' ', '&' or '?'. This breaks file names containing '://' and turns part of the file name into a comment.
Description of Fix:  Updated CD Requester to always add quotes around file names in the FILE parameter of COPY TO/FROM and SUBMIT statements.
Fix Availability Date:  02 February 2018
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix011:  RTC558935 / APAR IT24095
Description of Issue:  Secure+ incorrectly bypassed on the SNODE when it had no Secure+ remote node entry for the PNODE.
Description of Fix:  Resolved an issue with merging .Local and remote node settings. Also updated CSPA314W to show the node name in the message text.
Fix Availability Date:  14 May 2018
High Impact:  Y
Reported Severity:  3

4.7.0.5_iFix012:  RTC560221 / APAR IT24146
Description of Issue:  The CD Configuration Utility (CDConfig) fails to validate tcp.api.port or tcp.host.port initialization parameters when they specify multiple listener addresses. The error is:
E018 Line contained extra unrecognized data ('::1;1363').
Description of Fix:  Resolved.
Fix Availability Date:  21 February 2018
High Impact:  N
Reported Severity:  4

4.7.0.5_iFix013:  RTC562062 / APAR IT24136 / CVE-2017-3732, CVE-2017-3736, CVE-2018-1427
Description of Issue:  Vulnerabilities have been found in the IBM GSKit component used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs.
Description of Fix:  Updated the version of GSKit.
Fix Availability Date:  09 March 2018
High Impact:  Y
Reported Severity:  2

4.7.0.5_iFix014:  RTC557781 / APAR IT24600
Description of Issue:  Timer Retry logic can lose track of a process when a user manually releases the process from the Timer Retry queue and the timer fires while the process is still running. The process will not get a new timer but will remain in the Timer Retry queue appearing ‘stuck’.
Description of Fix:  Resolved.
Fix Availability Date:  29 March 2018
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix015:  RTC565355 / APAR IT24943
Description of Issue:  Processes to a remote node can remain on the WAIT queue after a user has increased Max PNode Sessions in the netmap entry. The processes work fine again after restarting the local node.
Description of Fix:  Resolved an issue with checking if a process can run. Improved error reporting to log LSMG418I with CC=16 when an exception was caught in the PNODE session manager.
Fix Availability Date:  29 May 2018
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix016:  RTC567875 / APAR IT25318 / CVE-2018-2602
Description of Issue:  A vulnerability has been found in the IBM Runtime Environment Java Technology Edition, Version 8 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated the IBM Runtime Environment Java.
Fix Availability Date:  11 June 2018
High Impact:  Y
Reported Severity:  2

4.7.0.5_iFix017:  RTC565959 / APAR IT25477
Description of Issue:  In some circumstances, an attempt to update the .Local node record via the CD Secure+ Admin Tool will fail reporting something similar to “Error #6 – Remote Node file not found.”
Description of Fix:  Fixed code so that updating the .Local node record via the Secure+ Admin Tool works normally.
Fix Availability Date:  25 June 2018
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix018:  RTC569191 / APAR IT25658
Description of Issue:  When sending multiple files to Connect:Direct HP NonStop, the first destination file on HP NonStop has the correct allocation settings, but the second and following files do not.
Description of Fix:  Resetting allocation parameters for each file.
Fix Availability Date:  12 July 2018
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix019:  RTC563441 / APAR IT25690
Description of Issue:  Message Short Text in some statistics can contain unbalanced double-quotes due to truncation of substitution parameters. This causes exception in AIJ.
Description of Fix:  Fixed code to check for unbalanced double-quotes and escape them.
Fix Availability Date:  13 July 2018
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix020:  MFT-9818 / APAR IT26154
Description of Issue:  .NetSDK sometimes hangs in call to SubmitFile.
Description of Fix:  Cleaned up code dealing with catching exceptions from cdcore.dll and throwing managed exceptions.
Fix Availability Date:  19 September 2018
High Impact:  N
Reported Severity:  2

4.7.0.5_iFix021:  MFT-9921
Description of Issue:  DBWiz command line parameters allowed specifying a database type that is not supported in this version.
Description of Fix:  The operation will fail now with an appropriate error message: Database type <dbtype> is not supported in Connect:Direct v<version>.
Fix Availability Date:  19 September 2018
High Impact:  N
Reported Severity:  4

4.7.0.5_iFix022:  MFT-9931
Description of Issue:  Server crashes when group authentication is used and CMGR tracing is enabled.
Description of Fix:  Resolved.
Fix Availability Date:  19 September 2018
High Impact:  Y
Reported Severity:  2

4.7.0.5_iFix023:  MFT-9918 / APAR IT26309
Description of Issue:  Server crashes when an SNODE session manager is failing with LSMG253I.
Description of Fix:  Resolved.
Fix Availability Date:  19 September 2018
High Impact:  Y
Reported Severity:  3

4.7.0.5_iFix024:  MFT-9987 / APAR IT26791 / CVE-2018-165, CVE-2018-12539
Description of Issue:  Vulnerabilities have been found in the IBM Runtime Environment Java Technology Edition, Version 8 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs.
Description of Fix:  Updated the IBM Runtime Environment Java.
Fix Availability Date:  30 October 2018
High Impact:  Y
Reported Severity:  2

4.7.0.5_iFix025:  MFT-9939
Description of Issue:  Remove dependencies on Microsoft Visual C++ 2008 runtime libraries.
Description of Fix:  Updated the version of GSKit to remove the dependencies. Removed the Microsoft Visual C++ 2008 Redistributable Package from setup prerequisites in the installer, so that it will no longer be installed on updates or installs.
Fix Availability Date:  31 October 2018
High Impact:  N
Reported Severity:  3

4.7.0.5_iFix026:  CDWA-526
Description of Issue:  CD Requester does not prevent the current user from deleting himself from Functional Authorities when the current user name does not exactly match the entry defined.
Description of Fix:  The check to prevent this has been updated to perform a case-insensitive comparison.
Fix Availability Date:  06 December 2018
High Impact:  N
Reported Severity:  4

4.7.0.5_iFix027:  CDWA-535
Description of Issue:  Add Support for Operator user in Connect:Direct windows and CD Requester.
Description of Fix:  Local functional authority type template is now updated to include a new Operator user type. An Operator user has Read-only permissions to view configuration files and monitor file transfers but not modify, delete or submit a process. To support this functionality both, Sterling Connect:Direct Requester and Sterling Connect:Direct for Microsoft Windows server must be upgraded to 4.7.0.6, 4.8.0.1, 6.0.0.2 or later.
Fix Availability Date:  11 December 2018
High Impact:  Y
Reported Severity:  5

All iFixes and fix packs listed above are accumulated in fix pack 6 (4.7.0.6).

iFixes after 4.7.0.6

4.7.0.6_iFix001:  MFT-10036 / APAR IT27758
Description of Issue:  When changing properties of a previous Select Statistics query in CD Requester, the Date/Time Range filter may eventually get lost.
Description of Fix:  Added code to preserve the Date/Time Range settings.
Fix Availability Date:  14 January 2019
High Impact:  N
Reported Severity:  3

4.7.0.6_iFix002:  MFT-10091 / APAR IT28000
Description of Issue:  SPADMIN GUI displays serial number in decimal.
Description of Fix:  Added code to convert Decimal serial number to Hex.
Fix Availability Date:  06 February 2019
High Impact:  N
Reported Severity:  4

4.7.0.6_iFix003:  CDUA-1233
Description of Issue:  SEAServer node's Override,ClientAuth,EncryptData parameter's update request should return error and shall not be displayed over SPCLI.
Description of Fix:  Stop update/display operation from SPCLI over SEAServer node's Override/ClientAuth/EncryptData parameters.
Fix Availability Date:  18 Feb 2019
High Impact:  N
Reported Severity:  4

4.7.0.6_iFix004:  MFT-10153
Description of Issue:  Substitution variables &ERC, &EFDBK and &ETXT are logged with some, mostly internal statistics message, but are never used and have incorrect values.
Description of Fix:  Removed the unused substitution variables.
Fix Availability Date:  21 February 2019
High Impact:  N
Reported Severity:  4

4.7.0.6_iFix005:  MFT-10244 / APAR IT28634 / CVE-2018-12547
Description of Issue:  A vulnerability has been found in the IBM Runtime Environment Java Technology Edition, Version 8 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated the IBM Runtime Environment Java.
Fix Availability Date:  01 April 2019
High Impact:  Y
Reported Severity:  2

4.7.0.6_iFix006:  CDWA-625
Description of Issue:  Proxies in Connect:Direct requires passwords to be stored for performing impersonation but stored passwords are difficult to manage.
Description of Fix:  To fix this problem password less proxy feature has been implemented.
Fix Availability Date:  09 April 2019
High Impact:  Y
Reported Severity:  5

4.7.0.6_iFix007:  MFT-10337 / APAR IT29581
Description of Issue:  Client connections sporadically failling with LCOA006I and LCOT000I.
Description of Fix:  Added retries around initializing an internal CMGR message queue. Improved error handling and added a new error message LMSG003E.
Fix Availability Date:  28 June 2019
High Impact:  N
Reported Severity:  3

4.7.0.6_iFix008:  MFT-10375 / APAR IT29623
Description of Issue:  Some older Secure+ settings are not reset during an upgrade installation. The current version 4.7.0 is fine, but these settings may cause issues during an upgrade to a newer version later on. Check the newer version for this fix, too.
Description of Fix:  Improved the Upgrade Parmfile command to handle and clear settings created by an older version of Secure+.
Fix Availability Date:  04 July 2019
High Impact:  N
Reported Severity:  2

4.7.0.6_iFix009:  CDWA-851
Description of Issue:  Server reports a wrong version number in legacy fields within the configuration report ([Server Property]CDVersion) and session exchange with a client (VERS).
Description of Fix:  Fixed. The use of these fields is deprecated.
Fix Availability Date:  11 July 2019
High Impact:  N
Reported Severity:  4

4.7.0.6_iFix010:  CDUA-1403
Description of Issue:  Invalid parameter "SPOV" coming in spcli output in KQV mode for seaserver.
Description of Fix:  Removed SPOV parameter from spcli output in KQV mode for seaserver.
Fix Availability Date:  23 August 2019
High Impact:  N
Reported Severity:  3

4.7.0.6_iFix011:  CDWA-902
Description of Issue:  The limit on sessions defined on Snode is not accounted for when processes are submitted.
Description of Fix:  Session limits not honored correctly on SNODE after it rejected sessions due to session limit exceeded.
Fix Availability Date:  28 August 2019
High Impact:  N
Reported Severity:  3

4.7.0.6_iFix012:  MFT-10642 / APAR IT30584
Description of Issue:  The server periodically deletes statistics older than stat.max.age. During the cleanup process the server was not able to log new statistics, which could block other activities, such as CD processes or sessions, and made the server appear to be unresponsive.
Description of Fix: Removed the blocking code.
Fix Availability Date:  10 October 2019
High Impact:  N
Reported Severity:  3

4.7.0.7_iFix013:  CDWA-1031
Description of Issue:  Added support for License governance in CD Windows code.
Description of Fix: Added support of three types of license (Solo, production and non-production) in CDW code.
Fix Availability Date:  18 November 2019
High Impact:  N
Reported Severity:  5

4.7.0.7_iFix014:  CDWA-1031
Description of Issue:  Added support in CD Windows for Control Center Director(CCD).
Description of Fix: Updated the CDW code for CCD support. New scripts are added for multiple tasks like start, stop, monitor, upgrade the CDW server. These scripts are getting called through CCD.
Fix Availability Date:  18 November 2019
High Impact:  N
Reported Severity:  5

All iFixes and fix packs listed above are accumulated in fix pack 7 (4.7.0.7).

iFixes after 4.7.0.7

4.7.0.7_iFix001:  MFT-10810
Description of Issue:  The Help command in CD Secure+ CLI (SPCli.cmd) does not list the 'Display KeyStore' command: SPCL010E rc=8 No help on this invalid command.
Description of Fix:  Updated the SPCli help.
Fix Availability Date:  19 December 2019
High Impact:  N
Reported Severity:  4

4.7.0.7_iFix002: CDWA-1028 
Description of Issue: Agent port field accepts 0 while installation and on updating initparms. The valid range is from 1 - 65535.
Description of Fix:  Fixed.
Fix Availability Date:  07 January 2020
High Impact:  N
Reported Severity:  4

4.7.0.7_iFix003:  MFT-10757 / APAR IT31493
Description of Issue:  Message ID JGIS049E not available in CD Message Lookup.
Description of Fix:  Updated the message file.
Fix Availability Date:  13 January 2020
High Impact:  N
Reported Severity:  4

4.7.0.7_iFix004:  MFT-10686 / APAR IT31845
Description of Issue:  Server and CD Configuration Utility (CDConfig.exe) crash when a proxy password exceeds the maximum length of 127 characters.
Description of Fix:  Improved parameter validation for adding or updating proxies and report errors, such as LCCA087I, LSCF004I or E062.
Fix Availability Date:  12 February 2020
High Impact:  N
Reported Severity:  2

4.7.0.7_iFix005:  CDWA-506
Description of Issue:  When opening a Netmap Node Properties dialog in CD Requester and closing it again with OK without making any updates, then the node is marked as changed and a yellow flag is displayed.
Description of Fix:  Resolved.
Fix Availability Date:  28 February 2020
High Impact:  N
Reported Severity:  4

4.7.0.7_iFix006:  CDWA-1099
Description of Issue:  Add support for disabling/enabling the install agent using an initparm.
Description of Fix:  A new parameter "agent.enable" has been added into record "install.agent" of initparm to start/stop install agent. Default value of the parameter is set to y(Enabled). To stop install agent, change value of agent.enable to n(Disabled). It takes upto 5 mins to start/stop install agent.
Fix Availability Date:  02 March 2020
High Impact:  N
Reported Severity:  5

4.7.0.7_iFix007:  MFT-10941 / APAR IT32107
Description of Issue:  Installation fails when the Secure+ KeyStore passphrase contains special characters.
Description of Fix:  Updated the installer to support the special characters except double quotes and to hide the passphrase from the installation log.
Fix Availability Date:  11 March 2020
High Impact:  N
Reported Severity:  3

4.7.0.7_iFix008:  MFT-10968 / APAR IT32369 / CVE-2019-4732
Description of Issue:  A vulnerability has been found in the IBM Runtime Environment Java Technology Edition, Version 7 and 8 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated the IBM Runtime Environment Java.
Fix Availability Date:  19 March 2020
High Impact:  Y
Reported Severity:  2

4.7.0.7_iFix009:  CDWA-812
Description of Issue:  Sending a file with datatype text may end prematurely when the file has UNIX-style line feeds. The COPY step is logged as successfully, though no all data was sent.
Description of Fix:  Resolved.
Fix Availability Date:  03 April 2020
High Impact:  Y
Reported Severity:  2