Security Notice

Incorporated into Information Server V3.6 is a security patch issued after the release of Service Pack 3. This patch addressed two security issues in SEARCH'97 Information Server 3.10 installations.

The DCM application, which listens to a particular port, did not require authentication. The daemon now restricts connections to the local host. The port number of the application can also be changed. If you are running the DCM daemon behind a firewall, you should assign a port that is below the firewall restricted ports threshold.
The result template variable was allowing users to substitute any file on the system using a relative path. This could provide access to any file on the system that the user account running the HTTP server had permission to read. The result template issue has been addressed by blocking the use of templates from anything other than result template directories registered in the Information Server. In addition, it is advised that you do not run the HTTP server on a system using an account with high privileges.

Upgrading to Information Server V3.6 will give you the protections provided by the security patch.

Copyright © 1998, Verity, Inc. All rights reserved.