English

ArcSDE 9.1 Three Tiered Connection Security Patch

Summary

This patch prevents the ArcSDE service from being affected by malicious connection packets.

Description


Issues Addressed with this Patch

    NIM007075 - The giomgr can be crashed by sending extra characters in the connectiion string.

    Description

    A security issue has been identified where it is theoretically possible for someone to create a connection packet that could cause the ArcSDE server to crash when using three tiered ArcSDE configurations (i.e., app server). Sending a maliciously-crafted connection packet to an ArcSDE service can crash the service. This will not happen under normal use of the software and we are unaware of any occasion when anyone has created one of these malicious packets. Therefore ESRI considers the risk of an attack to be very low. As a precaution ESRI has developed this patch to ArcSDE that will remove the ability for someone to create a malicious packet that could cause the system to crash and thereby secures the ArcSDE service against such an attack

Installing the Patch

ArcSDE 9.1 General Update Patch 3 must be installed before you can install this Patch. It is strongly recommended that you back up your database including all previous ArcSDE system tables and user layer data before upgrading your ArcSDE installation. Install this Patch using your SDE user account.

REQUIRED INSTALL STEP: If you connect to ArcSDE 9.1 via an Application Server and Direct Connect connections using ArcGIS 9.1, ArcIMS 9.1, or ArcView GIS 3.3 with DBA 2.1g make sure you also see ESRI Products connecting to ArcSDE (Application and Direct Connect connections).

Server Install for UNIX

During installation, you can either save the original 9.1 files or overwrite them. If you choose to save them, make sure you have enough disk space. The disk space requirements, for each platform, are displayed during the installation process.

  1. Download the appropriate tar file to a location other than $SDEHOME:
  2. DB2  
    HP64 sde91-securitypatch-db2-hp64.tar
    8 MB
    IBM sde91-securitypatch-db2-ibm.tar
    7 MB
    IBM64 sde91-securitypatch-db2-ibm64.tar
    7 MB
    Linux sde91-securitypatch-db2-lx.tar
    6 MB
    Solaris64 sde91-securitypatch-db2-slrs64.tar
    8 MB
       
    Informix  
    HP sde91-securitypatch-inf-hp.tar
    8 MB
    IBM sde91-securitypatch-inf-ibm.tar
    7 MB
    Solaris sde91-securitypatch-inf-slrs.tar
    7 MB

    For Oracle 8i/9i/10g, this issue has been addressed in the ArcSDE 9.1 Reconcile and Post Patch.


  3. Stop your current ArcSDE service.


  4. % sdemon -o shutdown

  5. Extract the specified tar file by typing:


  6. % tar -xvf sde91-securitypatch-<Database>-<Platform>.tar

  7. Start the installation by typing:


  8. % ./applypatch

    This will start the dialog for the menu-driven installation procedure. Default selections are noted in parentheses ( ). To quit the installation procedure, type 'q' at any time.

  9. To upgrade, run sdesetup<dbms>. Failure to do so may cause problems in starting the service or with connecting to the service. Using Oracle 9i as an example:


  10. % sdesetupora9i -o upgrade –u sde –p sdepassword

  11. Start your service again.


  12. % sdemon -o start

Server Install for Windows


Installation Steps


  1. Make sure you have write access to the ArcSDE installation folder, that no one is using ArcSDE, and that the ArcSDE service is down.


  2. Download the appropriate files to a location other than the ArcSDE installation folder:
  3. DB2  
    sde91-securitypatch-db2-win.exe 2 MB
    Informix  
    sde91-securitypatch-inf-win.exe 2 MB
    SQL Server  
    sde91-securitypatch-sql-win.exe 2 MB

    For Oracle 8i/9i/10g, this issue has been addressed in ArcSDE 9.1 Reconcile and Post Patch. You'll be able to access it from this page.


  4. Double-click the appropriate executable to start the install process.


  5. When Setup starts, follow the instructions on your screen.


  6. To upgrade, run sdesetup<dbms>. Failure to do so may cause problems in starting the service or with connecting to the service. Using Oracle 9i as an example:

    sdesetupora9i -o upgrade

  7. As the SDE user, run the following command to restart the ArcSDE service:

    sdemon -o start

ArcSDE SDK Install for UNIX


  1. Download the appropriate tar file to a location other than ArcSDE SDK installation location:
  2. All Databases (32 bit Operating System)  
    HP sde91-securitypatch-sdk-hp.tar
    2 MB
    IBM sde91-securitypatch-sdk-ibm.tar
    3 MB
    Linux sde91-securitypatch-sdk-lx.tar
    1 MB
    Solaris sde91-securitypatch-sdk-slrs.tar
    2 MB
       
    All Databases (64 bit Operating System)  
    HP64 sde91-securitypatch-sdk-hp64.tar
    2 MB
    IBM64 sde91-securitypatch-sdk-ibm64.tar
    3 MB
    Solaris64 sde91-securitypatch-sdk-slrs64.tar
    2 MB

  3. Extract the specified tar file by typing:


  4. % tar -xvf sde91-securitypatch-sdk-<Platform>.tar

  5. Start the installation by typing:


  6. % ./applypatch

    This will start the dialog for the menu-driven installation procedure. Default selections are noted in parentheses ( ). To quit the installation procedure, type 'q' at any time.

ArcSDE SDK Install for Windows


  1. Make sure you have write access to the ArcSDE SDK installation folder:.


  2. Download the appropriate files to a location other than the ArcSDE SDK installation folder:
  3. ArcSDE SDK sde91-securitypatch-sdk-win.exe 3 MB

  4. Double-click the appropriate executable to start the install process.


  5. When Setup starts, follow the instructions on your screen.

ESRI Products connecting to ArcSDE (Application and Direct Connect connections).

    UNIX

    • If you connect to ArcSDE 9.1 using ArcGIS 9.1 Workstation or ArcIMS 9.1 on any supported Unix/Linux platform please follow the steps below to install this Patch to your ArcGIS 9.1 or ArcIMS 9.1 software installation directory. This also applies if connecting to ArcSDE 9.1 using ArcGIS Server, ArcGIS Engine, and ArcGIS Reader for Sun Solaris and Linux:

      • Before you start, make sure you have write access to the installation directory then download the appropriate compressed tar file to that location:

        HP sde91-securitypatch-esri-hp.tar.Z
        2 MB
        IBM sde91-securitypatch-esri-ibm.tar.Z
        3 MB
        Linux sde91-securitypatch-esri-lx.tar.Z
        1 MB
        Solaris sde91-securitypatch-esri-slrs.tar.Z
        2 MB

      • ArcIMS only, stop the ArcIMS Tasker, ArcIMS Monitor, ArcIMS Application Server (in that order).

      • Uncompress and extract the specified tar file for your platform. Ensure that the last letter of the file name is a capital Z. Otherwise, the uncompress command will not work. At the UNIX prompt type:

        %cd <installation_directory> (i.e. cd $ARCHOME)

        • <Workstation Installation Directory>/lib
        • <ArcIMS Installation Directory>/lib
        • <ArcGIS Server Installation Directory>/bin
        • <ArcGIS Engine Installation Directory>/bin
        • <ArcGIS Reader Installation Directory>/bin
        %uncompress sde91-securitypatch-esri-<Platform>.tar.Z
        %tar xvf sde91-securitypatch-esri-<Platform>.tar

      • ArcIMS only, restart ArcIMS Application Server, ArcIMS Monitor and ArcIMS Tasker (in that order).


    Windows

    • If you connect to ArcSDE 9.1 using ArcGIS 9.1, ArcIMS 9.1, ArcInfo Workstation 9.1, or ArcView GIS 3.3 with DBA 2.1g, please follow the steps below to install this Patch to your ArcGIS 9.1, ArcIMS 9.1, ArcInfo Workstation 9.1, or ArcView GIS 3.3 with DBA 2.1g installation folder:

    • Before you start, make sure you have write access to the installation folder, then download the zip file to that location:

      sde91-securitypatch-esri-win.zip 3 MB

    • ArcIMS only, stop the ArcIMS Tasker, ArcIMS Monitor, ArcIMS Application Server (in that order).

    • Use WinZip to extract the new file from sde91-securitypatch-esri-win.zip to the appropriate installation folder, see list below:

      • ArcGIS Desktop, Server, Engine, Reader, or ArcView 9 - <installation-folder>\arcgis\bin
      • ArcGIS Workstation - <installation-folder>\arcexe9x\bin
      • ArcView GIS - <installation-folder>\av_gis30\arcview\(bin32 & DCONNECT\LIB)
      • Depending on the ArcIMS Setup features installed, the SDE client file could be located in one or more of the following locations:
        • C:\Program Files\ArcGIS\bin
        • C:\Program Files\ArcGIS\ArcIMS\IndexBuilder
        • C:\Program Files\ArcGIS\ArcIMS\Metadata\Commands
        • C:\Program Files\ArcGIS\ArcIMS\Server\bin

    • ArcIMS only, restart ArcIMS Application Server, ArcIMS Monitor and ArcIMS Tasker (in that order).

How to identify which Patch is installed


    UNIX

    To find out what ArcGIS products are currently installed on your machine, download and extract the PatchFinder.tar and run PatchFinder utility from your local machine. This utility provides a report detailing which ArcGIS products and which service packs have been installed. The PatchFinder utility searches for the following ArcGIS products.


      ArcGIS Engine Runtime
      ArcGIS Reader
      ArcGIS Server
      ArcIMS
      ArcInfo Workstation
      ArcSDE

    Extract the tar file by typing:


    % tar xvf PatchFinder.tar

    Run the utility by typing:


    % ./PatchFinder

    Windows

    To check for the presence of a Patch, for each file examine the unique identification information provided (right click, properties, version tab, item name, QFE Version). With only a few exceptions, all files modified as part of a Patch distribution can be uniquely identified in this manner. The identification string for this Patch should read:

      QFE-SDE-91-CQ00303306

Patch Updates

Check the Online Support Center periodically for the availability of additional Patches or Service Packs. New information about this Patch will be posted here.

    UPDATE 04/11/2007 - Now Available:

    • The ArcSDE Informix download for HP.
    • The ArcSDE SDK and ESRI Products downloads for HP.

    UPDATE 04/03/2007 - Now Available:

    • The ArcSDE Informix download for IBM.

Getting Help

Domestic sites, please contact ESRI Technical Support at 1-888-377-4575, if you have any difficulty installing this Patch. International sites, please contact your local ESRI software distributor.