InterSystems Product News, Alerts, and Advisories

InterSystems products use the glib library on supported platforms in limited fashion, but the library is not shipped as part of any InterSystems product. According the recently announced “GHOST” security vulnerability the glib library is a security risk.

The SSL 3.0 vulnerability documented recently in Reference: CVE-2014-3566 was expanded on December 8, 2014 to identify some implementations of TLS as being vulnerable too (CVE-2014-8730).

InterSystems has discovered and corrected a defect that can result in CSP session IDs being shared by two users. More specifically, there are situations where a new user for an application will be allocated a CSP session ID that has already been allocated to, and in use by, another user. The impact of this defect is application-dependent, but one possible consequence is the incorrect display of application data belonging to the session of another user.

InterSystems has discovered and corrected a defect in our web application technology used by the HealthShare portal and the Clinical Viewer. In rare circumstances, this defect can result in sharing of data by separate user sessions. This could lead to (a) a user having a different set of privileges and being able to access patient records they are not permitted to view or (b) being presented with clinical data from a different patient in the Clinical Viewer.

In response to the recently documented SSL 3.0 vulnerability (Reference: CVE-2014-3566), InterSystems advises customers to switch from using or requiring SSL 2.0 or SSL 3.0 and instead use only TLSv1.

InterSystems has corrected a defect that can impact data integrity. The defect is present in Caché, Ensemble, and HealthShare version 2013.1.0 and later.

The OpenSSL Project https://www.openssl.org recently released a security advisory on vulnerabilities in the OpenSSL product.

InterSystems has corrected a defect that causes incorrect calculation on Itanium platforms. The defect is present in InterSystems assembly optimizations targeted to Itanium platforms.

InterSystems has corrected a defect that can lead to $BIT operations over ECP being rolled back incorrectly.

InterSystems has corrected two defects with locking that, in rare circumstances, can cause shared memory corruption of lock structures. This condition can potentially lead to process failures and hung environments. These defects exist for Caché, Ensemble, and HealthShare.