Skip to content
Suchen Sie nach Produkten und Lösungen von InterSystems, Karrieremöglichkeiten und mehr.

HealthShare Alert: Potential Unauthorized Data Display

October 28, 2014 - HealthShare Alert: Potential Unauthorized Data Display

InterSystems has discovered and corrected a defect in our web application technology used by the HealthShare portal and the Clinical Viewer.  In rare circumstances, this defect can result in sharing of data by separate user sessions.  This could lead to (a) a user having a different set of privileges and being able to access patient records they are not permitted to view or (b) being presented with clinical data from a different patient in the Clinical Viewer.

The risk is low in typical configurations, but the defect impacts all currently released HealthShare versions.  It occurs only in environments using Microsoft Internet Information Server (IIS) version 7 and higher as its webserver.

This fault will only occur after IIS has recycled one of its worker processes, and the likelihood of encountering this problem increases with the recycling frequency of IIS worker processes.  As an example, frequent recycling of worker processes can occur in configurations where the ‘Idle Timeout’ defined for the Application Pool is set to a low value and, in particular, when the ‘Idle Timeout’ is set to a lower value than the HealthShare application timeout configured in HealthShare.  The settings controlling the recycling of worker processes can be found in the IIS control panel (Application Pool -> [Select Application Pool] -> Advanced Settings).  If the periodic recycling of worker processes is completely disabled in your IIS configuration then your installation will be unaffected by this issue, with the exception that IIS will always recycle a worker processes that either hangs or causes an unrecoverable error condition.

Please work with your system administrators to ensure IIS is configured to minimize any chance of this defect impacting your system and apply the patch available from InterSystems Worldwide Response Center (WRC).

InterSystems WRC can assist with reviewing the potential for this problem impacting your environment.

The correction for this defect is identified as CMT1273.  It will be included in upcoming HealthShare 2013.1 and 2014.1 maintenance releases, and is also available via Ad Hoc distribution from InterSystems WRC. If you have any questions regarding this advisory, please contact the Worldwide Response Center.

Latest Alerts & Advisories

15 Aug 2024
InterSystems has corrected a defect that can cause database corruption or errors with multi-volume databases under extremely rare circumstances. Only databases that have been truncated are at risk.
24 Jul 2024
There are four alerts in the HS2024-03 Alert Communication. A summary of each alert is shown below. Details for each alert are contained in the linked document.
24 Jun 2024
Broadcom recently announced a problem that can cause data consistency errors in database applications. The Broadcom article is available here:
30 May 2024
Beginning with the release of InterSystems IRIS® data platform 2022.3, InterSystems corrected the license enforcement mechanism to include REST and SOAP requests. Due to this change, environments with non-core-based licenses that use REST or SOAP may experience greater license utilization after upgrading. To determine if this advisory applies to your InterSystems license, follow the instructions in the FAQ linked below.
01 May 2024
InterSystems has corrected an issue that can cause a small number of SQL queries to return incorrect results. See below for the specifics on impacted queries.
08 Apr 2024
InterSystems has encountered a defect that causes some upgrades of HealthShare® Health Connect to fail. This only affects instances that are not licensed for the use of FHIR® and that have interoperability-enabled namespaces. Under these conditions, the upgrade fails with an error.
19 Mar 2024
In evaluating an IBM Support notification, InterSystems has determined a potential impact for our customers. The notification in question is:
27 Feb 2024
There is 1 alert in the HealthShare HS2024-limited Alert communication. An alert summary for the issue is shown is in the table below. Details for the alert are contained in the attached document: HS2024 Limited Communication.
01 Feb 2024
There are 2 alerts in the HealthShare HS2024-02 Alert communication. An alert summary for each issue is shown is in the table below. Details for each alert are contained in the attached document: HS2024-02-Communication.